jcoffey-dev
393eaa61ca
DKIM rotation and ACME renewal are queued only when a domain is saved into automatic mode, and each run queues the next. A domain whose first run never happened, or whose chain broke, kept its keys forever with nothing scheduled: on one server nine automatic domains had no DkimManagement task and keys with no nextTransitionAt. - The task scheduler checks daily, and five minutes after start, that every domain with automatic DKIM has a DkimManagement task and every domain with automatic certificates an AcmeRenewal task, and queues any that are missing. Only the node with the task scheduler role runs it. - A task counts as present in any state, failed included, so a domain whose task keeps failing isn't queued again every day. - DKIM: only when DNS publishes DKIM, or when the domain has no keys at all. Without publishing, a run neither rotates nor queues a follow-up. - ACME: a renewal that finds a still-valid certificate reschedules itself for when it falls due (#93), so queuing one orders nothing early. - Each re-queued task is logged as task-manager.task-queued, with the domain and "Re-queued a missing domain task". Tests: automation_tests' new orphaned-key part drops a domain's task and its keys' schedule, then checks the domain gets a task, the same keys get a schedule again, and a second check queues nothing.