Does LEGO saves the provider variables anywhere itself?

[germebl]

hey everyone,

actually working on a ansible playbook which should use LEGO as acme client. In the past i used acme.sh, so thats why this dumb question comes up...

For example using Hetzner DNS provider, i do a:

HETZNER_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
or
HETZNER_API_KEY_FILE=/etc/mytool/dns_hetzner.env

which is temporary setting the Environment Variable or path to the file...

Then i would run for example:

lego --email you@example.com --dns hetzner -d '*.example.com' -d example.com run

After this, does LEGO stores my environment variable set above anywhere or is it needed each time if the session was closed in between? So acme.sh saves it to be able to renew and i mostly think LEGO will do also - but just want to be sure ^^....

//Edit
Further as i'm here now... If i choose to set a file path, does it only need to contain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx or the full variable like HETZNER_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx?

[ldez]

Hi,

lego doesn't save environment variables, for security reasons.

But you can use env vars prefixed by _FILE to store your credentials.

https://go-acme.github.io/lego/dns/hetzner/index.html#credentials

[ldez]

//Edit
Further as i'm here now... If i choose to set a file path, does it only need to contain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx or the full variable like HETZNER_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx?

Only xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.

Example:

• HETZNER_API_KEY=/path/to/myfile

content of /path/to/myfile:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

[germebl]

Thank you for your fast answer - so when setting _FILE prefixed env var, lego still doesnt store this env var so i would need to make it permanent myself or set it temp before each renew? So when i understand the renew docs correct in combination with the scenario above, even the renew needs to be mostly manually in this case, to be most secure?

In this case i would do something like a cronjob, which sets the env from the file and then does the renew...best practice?

Like this for example?

35 3 * * *  HETZNER_API_KEY_FILE=/path/to/myfile && /usr/bin/lego --email you@example.com --dns hetzner -d '*.example.com' -d example.com renew

[ldez]

i would need to make it permanent myself

yes, the file management must be done by yourself.

Your example is right.