Add hook callback before privkey loading, e.g. "preload_cert" #358

New Issue

2025-12-29T01:23:39+01:00

adam commented

2025-12-29 01:23:39 +01:00

Originally created by @nyurik on GitHub (Jun 27, 2018).

In some cases, an external storage is used to keep the keys between runs, e.g. a HashiCrop's Vault. In order to use it, the certs/ dir needs to be restored for the specific domains that are being validated. Please add a new hook, e.g. this code, to allow for this to happen. I am not a bash expert, so there might be a need of some wrapper code to prevent older hooks from failing. Thx!

This code should be placed after certs dir is created, but before it loads any data from it: https://github.com/lukas2511/dehydrated/blob/10d4b98e7f1e2c5e0e5b16b0896aa7180e5a88f5/dehydrated#L1195

    # allow hook to restore certificate state right before we load it
    [[ -n "${HOOK}" ]] && "${HOOK}" "preload_cert" "${domain}" "${certdir}"

Originally created by @nyurik on GitHub (Jun 27, 2018). In some cases, an external storage is used to keep the keys between runs, e.g. a HashiCrop's Vault. In order to use it, the `certs/` dir needs to be restored for the specific domains that are being validated. Please add a new hook, e.g. this code, to allow for this to happen. I am not a bash expert, so there might be a need of some wrapper code to prevent older hooks from failing. Thx! This code should be placed after certs dir is created, but before it loads any data from it: https://github.com/lukas2511/dehydrated/blob/10d4b98e7f1e2c5e0e5b16b0896aa7180e5a88f5/dehydrated#L1195 ```bash # allow hook to restore certificate state right before we load it [[ -n "${HOOK}" ]] && "${HOOK}" "preload_cert" "${domain}" "${certdir}" ```

adam closed this issue

2025-12-29 01:23:39 +01:00

adam commented

2025-12-29 01:23:39 +01:00

@lukas2511 commented on GitHub (Dec 11, 2020):

This seems like a very niche use case to me and I'm guessing that this behavior could simply be implemented using a wrapper script or during the startup hook, especially since dehydrated would call it for every single certificate anyways, might as well do it in batch.

@lukas2511 commented on GitHub (Dec 11, 2020): This seems like a very niche use case to me and I'm guessing that this behavior could simply be implemented using a wrapper script or during the startup hook, especially since dehydrated would call it for every single certificate anyways, might as well do it in batch.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/dehydrated#358