This proved to be blessedly simple. As per the documentation, any executable in /etc/letsencrypt/renewal-hooks/deploy will be run after a certificate was successfully renewed (may need to be owned by root). This worked first time: #!/bin/bash   cp -L /etc/letsencrypt/live/<domain>/{fullchain,privkey}.pem /etc/exim4/ chown Debian-exim:Debian-exim /etc/exim4/{fullchain,privkey}.pem systemctl restart exim4#!/bin/bash cp -L /etc/letsencrypt/live/<domain>/{fullchain,privkey}.pem /etc/exim4/ chown Debian-exim:Debian-exim /etc/exim4/{fullchain,privkey}.pem systemctl restart […]

At some point, my Nextcloud quietly stopped being able to send email. This is currently Nextcloud 27.1.3, running in docker on Debian 11.8, but it might have been broken for some time. When setting up exim on Debian, debconf asks you a few questions and generates a default config. My setup has no other deviations […]