inbuxa/inbuxa-server
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 39 Wiki Activity Sponsor

Re-queue DKIM rotation and certificate renewal a domain is missing #201

Merged
jcoffey-dev merged 1 commits from self-heal-domain-tasks into main 2026-10-16 15:34:52 +00:00
Conversation 0 Commits 1 Files Changed 4
+412
1 Commits
Author SHA1 Message Date
jcoffey-dev 393eaa61ca Re-queue DKIM rotation and certificate renewal a domain is missing
ci / fork-checks (pull_request) Skipped
Details
ci / build (pull_request) Skipped
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 25m6s
Details 
DKIM rotation and ACME renewal are queued only when a domain is saved
into automatic mode, and each run queues the next. A domain whose first
run never happened, or whose chain broke, kept its keys forever with
nothing scheduled: on one server nine automatic domains had no
DkimManagement task and keys with no nextTransitionAt.

- The task scheduler checks daily, and five minutes after start, that
  every domain with automatic DKIM has a DkimManagement task and every
  domain with automatic certificates an AcmeRenewal task, and queues
  any that are missing. Only the node with the task scheduler role
  runs it.
- A task counts as present in any state, failed included, so a domain
  whose task keeps failing isn't queued again every day.
- DKIM: only when DNS publishes DKIM, or when the domain has no keys at
  all. Without publishing, a run neither rotates nor queues a follow-up.
- ACME: a renewal that finds a still-valid certificate reschedules
  itself for when it falls due (#93), so queuing one orders nothing
  early.
- Each re-queued task is logged as task-manager.task-queued, with the
  domain and "Re-queued a missing domain task".

Tests: automation_tests' new orphaned-key part drops a domain's task
and its keys' schedule, then checks the domain gets a task, the same
keys get a schedule again, and a second check queues nothing.
 2026-10-16 08:08:54 -07:00