Enable debug/verbose output

[asbachb]

I'm currently facing a problem with lego on NixOS. I wonder if I can increase the logging somehow. I could not find any debug/verbose toggle to increase verbotisity for lego somehow.

[ldez]

Hello,

There is no debug/verbose mode, all the existing logs are displayed.

What is your problem?

[asbachb]

I'm using mail.domain.tld. I double checked the token. It's able to fetch the zones.

[ldez]

The error is directly related to the Cloudflare API:

• cloudflare: failed to find zone domain.tld.: is the message inside lego
• zone could not be found is the response of the Cloudflare API

So either the domain (it's the first level domain -> zone) used to call the API is not right (related to a CNAME wildcard) or you have a problem with the rights related to your token.

[asbachb]

I suspect it might have something to do with the systemd configuration as it seems to work when I invoke lego manually.

CLOUDFLARE_DNS_API_TOKEN=MY_SECRET_TOKEN lego --accept-tos --path . -d mail.impl.it --email [email protected] --key-type ec256 --dns cloudflare --dns.resolvers 1.1.1.1 run
2022/11/19 14:16:33 No key found for account [email protected]. Generating a P256 key.
2022/11/19 14:16:33 Saved key to accounts/acme-v02.api.letsencrypt.org/[email protected]/keys/[email protected]
2022/11/19 14:16:34 [INFO] acme: Registering account for [email protected]
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "accounts".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2022/11/19 14:16:34 [INFO] [mail.impl.it] acme: Obtaining bundled SAN certificate
2022/11/19 14:16:35 [INFO] [mail.impl.it] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/178036982257
2022/11/19 14:16:35 [INFO] [mail.impl.it] acme: Could not find solver for: tls-alpn-01
2022/11/19 14:16:35 [INFO] [mail.impl.it] acme: Could not find solver for: http-01
2022/11/19 14:16:35 [INFO] [mail.impl.it] acme: use dns-01 solver
2022/11/19 14:16:35 [INFO] [mail.impl.it] acme: Preparing to solve DNS-01
2022/11/19 14:16:37 [INFO] cloudflare: new record for mail.impl.it, ID d0d3442643b554d63814375e646aa56a
2022/11/19 14:16:37 [INFO] [mail.impl.it] acme: Trying to solve DNS-01
2022/11/19 14:16:37 [INFO] [mail.impl.it] acme: Checking DNS record propagation using [1.1.1.1:53]
2022/11/19 14:16:39 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s]
2022/11/19 14:16:39 [INFO] [mail.impl.it] acme: Waiting for DNS record propagation.
2022/11/19 14:16:49 [INFO] [mail.impl.it] The server validated our request
2022/11/19 14:16:49 [INFO] [mail.impl.it] acme: Cleaning DNS-01 challenge
2022/11/19 14:16:50 [INFO] [mail.impl.it] acme: Validations succeeded; requesting certificates
2022/11/19 14:16:52 [INFO] [mail.impl.it] Server responded with a certificate.

systemd unit

[Unit]
After=network.target network-online.target acme-fixperms.service nss-lookup.target acme-selfsigned-mail.impl.it.service
Description=Renew ACME certificate for mail.impl.it
Wants=network-online.target acme-fixperms.service acme-selfsigned-mail.impl.it.service

[Service]
Environment="LOCALE_ARCHIVE=/nix/store/wqzfxm6fni76h5w9m17q7zkl7h7isk96-glibc-locales-2.35-163/lib/locale/locale-archive"
Environment="PATH=/nix/store/g1dma87br1c6475cmrxhnx6y95z3gr5j-lego-4.9.0/bin:/nix/store/a7gvj343m05j2s32xcnwr35v31ynlypr-coreutils-9.1/bin:/nix/store/j9p3g8472iijd50vhdprx0nmk2fqn5gv-diffutils-3.8/bin:/nix/store/fq47cv26nb87hwz2678r6i8ym5b57lwf-openssl-3.0.7-bin/bin:/nix/store/a7gvj343m05j2s32xcnwr35v31ynlypr-coreutils-9.1/bin:/nix/store/mydc6f4k2z73xlcz7ilif3v2lcaiqvza-findutils-4.9.0/bin:/nix/store/86bp03jkmsl6f92w0yzg4s59g5mhxwmy-gnugrep-3.7/bin:/nix/store/89zs7rms6x00xfq4dq6m7mjnhkr8a6r4-gnused-4.8/bin:/nix/store/q11j05nqg829dkvgc8851mscbzi2iq8n-systemd-251.7/bin:/nix/store/g1dma87br1c6475cmrxhnx6y95z3gr5j-lego-4.9.0/sbin:/nix/store/a7gvj343m05j2s32xcnwr35v31ynlypr-coreutils-9.1/sbin:/nix/store/j9p3g8472iijd50vhdprx0nmk2fqn5gv-diffutils-3.8/sbin:/nix/store/fq47cv26nb87hwz2678r6i8ym5b57lwf-openssl-3.0.7-bin/sbin:/nix/store/a7gvj343m05j2s32xcnwr35v31ynlypr-coreutils-9.1/sbin:/nix/store/mydc6f4k2z73xlcz7ilif3v2lcaiqvza-findutils-4.9.0/sbin:/nix/store/86bp03jkmsl6f92w0yzg4s59g5mhxwmy-gnugrep-3.7/sbin:/nix/store/89zs7rms6x00xfq4dq6m7mjnhkr8a6r4-gnused-4.8/sbin:/nix/store/q11j05nqg829dkvgc8851mscbzi2iq8n-systemd-251.7/sbin"
Environment="TZDIR=/nix/store/i16lgq16av602nfyws3ps8dd9yj36dwh-tzdata-2022f/share/zoneinfo"



BindPaths=/var/lib/acme/.lego/accounts/3b657f26d3963f48c2d5:/tmp/accounts
BindPaths=/var/lib/acme/mail.impl.it:/tmp/out
BindPaths=/var/lib/acme/.lego/mail.impl.it/113f6aa7d81c981555f0:/tmp/certificates
CapabilityBoundingSet=
DevicePolicy=closed
EnvironmentFile=/etc/nixos/credentials/lego/restocknerd.com-cloudflare-api-token
ExecStart=/nix/store/1vah3v7vp2s7kj1wqfxiaizmr96a0k7q-unit-script-acme-mail.impl.it-start/bin/acme-mail.impl.it-start
ExecStartPost=+/nix/store/fgqcpj62wrfippwjaihyb6z9d5pxz6xm-acme-postrun
Group=acme
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/acme
RemoveIPC=true
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
StateDirectory=acme/mail.impl.it
StateDirectory=acme/.lego/mail.impl.it
StateDirectory=acme/.lego/mail.impl.it/113f6aa7d81c981555f0
StateDirectory=acme/.lego/accounts/3b657f26d3963f48c2d5
StateDirectoryMode=750
SystemCallArchitectures=native
SystemCallFilter=@system-service @resources
SystemCallFilter=~@privileged
SystemCallFilter=@chown
Type=oneshot
UMask=0022
User=acme
WorkingDirectory=/tmp

/etc/nixos/credentials/lego/restocknerd.com-cloudflare-api-token is readable for everyone, including acme user.

[ldez]

I cannot help you with systemd configuration.
Check the env vars file: typo, hidden chars, etc.

[asbachb]

Finally recognized that I linked the wrong credentials. Sorry for the noise.