The entrypoint script in nginx-certbot invokes kill -HUP to send a SIGHUP to nginx, so that it reloads its config. This may not work in environments where the container is monitored for any signals sent and interpreted as failure (eg AWS Elastic Beanstalk, where this behaviour is observed).
To mitigate this, we propose the following:
- Modify
entrypoint.sh so that the certbot poller is implemented in a separate script and run in a separate process, and;
- Introduce an optional parameter that delays starting the poller for a given number of seconds
A rough sketch of what this might look like can be found at isomerpages/isomer-redirection@07d7f13.