Tasks: a renewal created over the API replaces the domain's queued one #308

Merged

jcoffey-dev merged 1 commits from fix/task-renewal-replaces-queued into main

2026-11-07 01:17:37 +00:00

jcoffey-dev commented

2026-11-07 00:54:18 +00:00

Owner

Creating an AcmeRenewal task through x:Task/set, or a DNS task with onSuccessRenewCertificate, now clears the domain's queued renewals first. Saving a domain already does this (#290); the task API didn't. Each renewal queues the next, so a second task meant a second chain of renewals for good.

A second renewal for the same domain in one request is refused (invalidProperties), since the first one isn't written yet when the second is checked.

Part of inbuxa/inbuxa-admin#167. The console's Order again doesn't depend on this: it tells the existing task to run now (status Pending, due now) and only creates one when nothing is queued.

Tests (automation::automation_tests with Pebble, passing):

a renewal created over the API leaves one queued renewal;
two in one request: the second is refused;
a queued renewal patched to Pending now runs, finds the certificate still valid, and reschedules for when it falls due. createdAt is server-set, so the patch sends only @type and due.

Fork checks, cargo fmt --check, and clippy on the changed file are clean.

Creating an `AcmeRenewal` task through `x:Task/set`, or a DNS task with `onSuccessRenewCertificate`, now clears the domain's queued renewals first. Saving a domain already does this (#290); the task API didn't. Each renewal queues the next, so a second task meant a second chain of renewals for good. A second renewal for the same domain in one request is refused (`invalidProperties`), since the first one isn't written yet when the second is checked. Part of inbuxa/inbuxa-admin#167. The console's Order again doesn't depend on this: it tells the existing task to run now (status `Pending`, `due` now) and only creates one when nothing is queued. **Tests** (`automation::automation_tests` with Pebble, passing): - a renewal created over the API leaves one queued renewal; - two in one request: the second is refused; - a queued renewal patched to `Pending` now runs, finds the certificate still valid, and reschedules for when it falls due. `createdAt` is server-set, so the patch sends only `@type` and `due`. Fork checks, `cargo fmt --check`, and clippy on the changed file are clean.

jcoffey-dev added 1 commit 2026-11-07 00:54:18 +00:00

Tasks: a renewal created over the API replaces the domain's queued one

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 15m7s

Details

23d746e396

Saving a domain already clears its queued certificate renewals before
queuing a new one (#290), because each renewal queues the next and two
would keep renewing for good. Creating an AcmeRenewal task, or a DNS task
that renews the certificate after, through x:Task/set skipped that, so a
client could start a second chain. It now clears them the same way, and
refuses a second renewal for the same domain in one request.

The test also covers telling a queued renewal to run now by setting its
status to Pending, which the console's Order again uses (inbuxa-admin#167).

jcoffey-dev referenced this pull request from inbuxa/inbuxa-admin

2026-11-07 01:08:17 +00:00

Certificates: order one with the names you choose, and order again #170

jcoffey-dev merged commit debae3aa95 into main

2026-11-07 01:17:37 +00:00

jcoffey-dev deleted branch fix/task-renewal-replaces-queued

2026-11-07 01:17:37 +00:00

jcoffey-dev referenced this pull request

2026-11-07 01:20:39 +00:00

Version 27.1-rc.12 #309