From 91b8ad76e0712b7dc8cd1e22b158518406b29fcb Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 11 Jan 2026 17:34:36 +0100 Subject: [PATCH] nixos/acme: Make the maximum jitter configurable Extracts the fixed 24h random delay into a configurable option suitable for other profiles, that require different renew intervals. With the introduction of LE's shortlived profile a fixed random delay does not cut it anymore, as it will delay short renew intervals by up to a day before they are run. In an ideal world we could make the delay proportional to the renew interval, but the `OnCalendar=` format is a bit too complicated. --- nixos/modules/security/acme/default.nix | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix index c03dd38ce472..41249834242f 100644 --- a/nixos/modules/security/acme/default.nix +++ b/nixos/modules/security/acme/default.nix @@ -330,7 +330,7 @@ let # the course of the day to avoid rate limits. AccuracySec = "${toString (_24hSecs / numCerts)}s"; # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/. - RandomizedDelaySec = "24h"; + RandomizedDelaySec = data.renewJitter; FixedRandomDelay = true; }; }; @@ -637,6 +637,18 @@ let description = '' Systemd calendar expression when to check for renewal. See {manpage}`systemd.time(7)`. + + If you reduce this from daily you might also want to adapt {option}`security.acme.defaults.renewJitter`. + ''; + }; + + renewJitter = lib.mkOption { + type = lib.types.str; + inherit (defaultAndText "renewJitter" "24h") default defaultText; + description = '' + Maximum jitter applied to a timer to stretch its execution + intervals to prevent multiple timers from firing simultaneously. See + `RandomizedDelaySecs=` in {manpage}`systemd.timer(5)`. ''; };