Remove requirement for config directory to be writable

[stevenroose]

F.e. when using certbot in Docker (with the official certbot image), it's good practice to have a read-only volume for the config directory. However, this gives the following error:

letsencrypt_1    | Saving debug log to /var/log/letsencrypt/letsencrypt.log
letsencrypt_1    | The following error was encountered:
letsencrypt_1    | [Errno 13] Permission denied: '/etc/letsencrypt/.certbot.lock'
letsencrypt_1    | Either run as root, or set --config-dir, --work-dir, and --logs-dir to writeable paths.

I did set work-dir = /tmp/certbot, so it's only the config directory that is not writable.

[schoen]

@bmw, this seems to be a policy question about which directory is used for the overall lockfile and whether it would be better if it were kept in the work_dir rather than the config_dir. Do you have any comments about this?

[bmw]

Certbot stores things like the certificate and private keys it obtains in your config directory so I think it needs to be writeable. You could argue that those things should be stored elsewhere, but we're not in a position to change this behavior anytime soon.

For this reason, I'm closing this PR, but please comment if you think I've missed something or should reconsider.

(@schoen, fun fact: Because all three Certbot directories can be configured to arbitrary paths, Certbot puts a lockfile in each of the config, work, and logs directories.)

[stevenroose]

It just seems a bit strange that the resulting certificates are placed in "config dir". That kinda works against the name of the directory. More general than this issue, I think it makes more sense to have a read-only config dir and a writable certificate dir. That's what I assumed the work-dir was .

[bmw]

There's definitely an argument for that, but we've had the current behavior since Let's Encrypt launched their beta at the end of 2015. We even had it before that as when I started working on the project in early 2015, things already worked this way. We could potentially change it in the future, but because there are millions of Certbot users, many of whom run Certbot non-interactively, I don't think we can change this now. We'd need to have a hard break and release Certbot2 or something.

For your information though, the config directory as Certbot uses it is user facing data (besides logs which are stored in /var/log/letsencrypt by default). The work directory contains things like backups of your Apache/Nginx configuration if you're using those plugins and isn't meant to be modified by users in any way.