fix: clean up ACME certs when resources are deleted #212

New Issue

MrUnknownDE · 2026-04-05T17:02:41+02:00

MrUnknownDE commented

2026-04-05 17:02:41 +02:00

Originally created by @shreyaspapi on 2/23/2026

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Fixes #2382

What's wrong

When you delete a resource, Traefik keeps its certificate in acme.json and keeps renewing it forever. The deleteResource handler only removes the DB row — it never touches the ACME storage.

What this does

After deleting a resource, checks if any other resource still uses the same domain
If not, removes that domain's certificate from acme.json so Traefik stops renewing it
Adds a configurable acme_json_path option (defaults to /app/config/letsencrypt/acme.json)
The cleanup is best-effort — if it fails for any reason, the delete still succeeds

How to test?

Create a resource with a custom domain that gets a Let's Encrypt cert
Delete that resource
Verify the domain's cert is removed from acme.json
Verify that domains shared by other resources are NOT removed

*Originally created by @shreyaspapi on 2/23/2026* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Fixes #2382 ## What's wrong When you delete a resource, Traefik keeps its certificate in `acme.json` and keeps renewing it forever. The `deleteResource` handler only removes the DB row — it never touches the ACME storage. ## What this does - After deleting a resource, checks if any other resource still uses the same domain - If not, removes that domain's certificate from `acme.json` so Traefik stops renewing it - Adds a configurable `acme_json_path` option (defaults to `/app/config/letsencrypt/acme.json`) - The cleanup is best-effort — if it fails for any reason, the delete still succeeds ## How to test? 1. Create a resource with a custom domain that gets a Let's Encrypt cert 2. Delete that resource 3. Verify the domain's cert is removed from `acme.json` 4. Verify that domains shared by other resources are NOT removed

MrUnknownDE closed this issue

2026-04-05 17:02:41 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#212