Repository navigation
docs: document volatile ban/rate-limit state and the ACME contact email - #376
Merged
Merged
Conversation
The install guide claimed ban/rate-limit state is persisted in Docker volumes. It is not: both live in HAProxy stick-tables, which a reload or a recreated container starts empty, so a single "Apply configuration" drops every ban and request counter. Document the mechanism in docs/architecture.md and correct the claim in release/README.md, alongside what an upgrade does carry over and what it does not — certbot's ACME account key and renewal configuration sit in the backend container's /tmp, while the issued certificate lives in the database and on the shared runtime volume. The guide's ADMIN_EMAIL example is also the ACME contact for the built-in certificate flow, and Let's Encrypt rejects reserved domains such as example.com at account registration, which fails every certificate request with a cryptic error. Say so next to the example.
bihius
added a commit
that referenced
this pull request
Oct 14, 2026
Keeps #376's ban/rate-limit and ACME documentation, and applies the beta wording to its rewritten beta-status paragraph.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while running a beta.7 → beta.8 upgrade end to end from the published
kits on a test host.
Ban/rate-limit state is not persisted, contrary to what the install guide
said: both live in HAProxy stick-tables, which are held in the HAProxy
process's memory. A graceful reload — including Apply configuration, which
reloads through the master socket — starts a fresh worker with empty tables,
so every ban and every request counter is dropped; so does restarting or
recreating the container. Measured: a ban at
gpc0=6was gone (GET /security/banned-ipsreturned an empty list) right after an apply that onlyadded an unrelated vhost. A tag-only upgrade does not recreate the pinned
haproxycontainer, so the tables do survive that specific upgrade — butnothing guarantees it.
docs/architecture.md(thefeature had no page there at all).
release/README.mdand add a "What an upgrade does notcarry over" subsection covering both volatile pieces of state.
ACME contact address:
ADMIN_EMAILfrom the install guide's seed step isalso the ACME contact for the built-in certificate flow. Let's Encrypt rejects
reserved domains such as
example.comat account registration, so a testerwho leaves the guide's
you@example.complaceholder gets a cryptic failure onevery certificate request — verified against LE production:
Unable to register an account with ACME server. The ACME server believes admin@example.com is an invalid email address.A note next to the example is enough to stop it.Also noted while testing, not changed here: the renewal job
(
app/services/scheduler.py) always usesadmin@<vhost domain>as the ACMEcontact instead of the creating admin's address, unlike the create path. It
only matters for a domain LE finds unacceptable, so it is left alone.
Docs only — no code, config or test changes.