Unclear how to setup with non-root user

[irl]

Configuring to use a non-root user for renewal sounds great but it appears that nothing sets filesystem permissions to allow that user to perform the renewals, and the documentation doesn't explain how it's meant to work.

[github-actions]

This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark issues as stale.

[irl]

I worked around this by not using this role, and instead I am using certbot in podman with my own role to achieve certbot running as non-root user.

I still think the issue exists, I think it is a documentation issue, and I think it should be fixed. The fix could be removing the certbot_auto_renew_user variable, or documenting how it is meant to be used.

@ron1 gave this issue a thumbs up so maybe has more to add.

[ron1]

Hi @irl,

Is the role you are using publicly available?

[irl]

Yes but it’s not polished and is bundled with nginx: https://guardianproject.dev/irl/ansible-collection-wip/src/branch/main/roles/podman_nginx

…

On Wed, Jul 2, 2025, at 7:41 AM, ron1 wrote: *ron1* left a comment (geerlingguy/ansible-role-certbot#231) <#231 (comment)> Hi @irl <https://github.com/irl>, Is the role you are using publicly available? — Reply to this email directly, view it on GitHub <#231 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJHCS777KPT4WDGCO4WHJ33GN5JNAVCNFSM6AAAAABYEHZY26VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMRWGY2DKMRVGE>. You are receiving this because you were mentioned.Message ID: ***@***.***>