Despite that knowledge base page, ddns.net is on the public suffix list (submitted by a NO-IP representative I note) so it should work with Let's Encrypt?! I suspect that the KB page only applies to 3rd party purchased certificates (you need to provide documented ownership of a domain to purchase a certificate for it from a 3rd party). Because Let's Encrypt does not require documentation to generate a cert (just proof of control via the serving the required challenges or DNS settings) I suspect that it doesn't apply to Let's Encrypt certificates (and your issue lays somewhere else). I'd be interested to see the specific error messages that you get when you try (if you want to try again).

Anyway, re your updating/upgrading experience, could you please elaborate? TBH, I have quite limited experience with ghost, but I'm generally pretty handy with this sort of stuff... :)

How have you tried to update? What was the specific result? If you get an error message, then please post it verbatim.

FWIW a quick google lead me to this tutorial which looks promising on face value. This official page also looks of value. And the ghost-cli doc page might also be useful?! Finally the page that notes changes between versions might also be worth a read.

Changing from https to http (or vice versa)

There should have been no need to re-install from scratch. Apologies that I didn't spell out how to manually rerun the firstboot script. I often suffer from the curse of knowledge. When I don't, I often tend to go the opposite direction and get bogged down in the minutia and often important bits are buried...

Anyway, you can rerun the ghost firstboot script (that I linked to in my first post) manually like this:

/usr/lib/inithooks/bin/ghost.py

FWIW, as an aside, any files in the appliance buildcode that are in the overlay directory (link to Ghost's overlay directory as an example; but this applies to all appliances) end up on your server, relative to the root ('/') directory. So 'overlay/usr/lib/inithooks/bin/ghost.py' ends up as '/usr/lib/inithooks/bin/ghost.py'. (Just to confuse you, there are some exceptions to that rule, where files are only used during the build and later removed, but generally, they should always be within overlay/usr/local/...). If you are at all curious just ask and I'll do my best to explain.

Having said that, firstboot scripts are only written to be run at firstboot. They must be able to run multiple times without destroying the pre-installed application, but they aren't tested with user data. So there is a risk (albeit small) that it may wipe out your data (it shouldn't, but I can't be 100% sure). So if you do re-run a firstboot inithook, make sure that you have a backup of your data first.

As an additional point, looking at the ghost firstboot script I can only see the schema (i.e. the 'http://' or 'https://' bit) being set in the ghost config file ('/opt/ghost/config.production.json'). So another alternative would be to edit that file and swap any mention of https with http. Be careful to make sure that the formatting is correct. json files have a very specific format and whilst they're relatively easy to read by humans, they are machine readable, so messing up formatting will break them. I'd offer a sed line to do the swap for you, but I don't have a ghost appliance handy and would need to double check against the config file before I'd be willing to provide one. (FYI 'sed' is a neat way to edit files in place programatically). If you'd like to paste your Ghost config file here, I could provide you with one.

But obviously re-installing from scratch also works... :)

Dehydrated/Let's Encrypt

Re Dehydrated, yes we have an issue with that currently (actually a few separate issues that all occurred around the same time). We have a proper fix in the pipeline, but I still need to do final testing and package it so that users can easily apply the fix.

In the meantime, you can try the (slightly convoluted) workaround documented on the first post on the relevant issue. But please note that it only works reliably when you are using a single domain (I tested with 2 and it also worked, but others ave reported it can be hit and miss, even with 2). So that may well have been the issue you hit? Although it's worth noting that only occurred relatively recently (about a month, month and a half ago). So if you had issues before then, then these newer problems may not be related to your previous issue.

Updating Ghost

Re updating Ghost. Firstly, that page you link to is for when Ghost is installed as the root user, to the root user's home directory. As you note, we install Ghost to /opt/ghost, but we don't install ghost as root user, we install it via a generic limited 'node' user (all of our nodejs based apps use that same user account).

FWIW there are some upgrade instructions documented on the appliance page (look for the "Supervised Manual Ghost Update" heading). Although, I note that they probably need an update to use the 'ghost-cli' tool instead of being completely manual.

So the only part of those instructions that you link to that are relevant on a TurnKey appliance, would be the very last line:

su - node

As per the upgrade instructions on the appliance page, you can use the '-c' switch to just run specific commands as the node user (rather than completely change to that user account via the above command). E.g. to run "some command" as the node user in your Ghost install directory:

cd /opt/ghost
su -c 'some command' node

FWIW you could use double quotes around the 'some command' instead of single quotes, but they have slightly different meaning in bash, so if something isn't working as you expect, you could retry with the other quotes.

As you've already run some commands in /opt/ghost as root (as the message that you get notes), then that's likely changed (read; broken) some of the Ghost file/directory permissions. This should restore them to what they should be:

chown -R node:node /opt/ghost

So to do the upgrade using the ghost-cli as the 'node' user, my reading suggests that this should do the trick:

cd /opt/ghost
su -c 'npm i -g ghost-cli@lates' node
su -c 'ghost update' node

Note that I haven't tested that, so YMMV. I hope that helps. Please let us know how it goes.

Sudo will ask for a password, but su shouldn't?! So I'm not quite sure what is going on there... I'll have to set up a Ghost server myself and have a closer look sometime soon (please bump me if you don't hear anything in the next few days).

In the meantime, there is now a "proper" fix for Let's Encrypt (Confconsole/Dehydrated) with the release of Confconsole v1.1.1. It's not yet available from our repos (although will be soon) and still requires some specific steps to install and set up on a v15.x server (although better than instructions published previously).

Please note that users who have already updated via various other means are still recommended to install this update as it includes reliability fixes for add-water; our custom challenge mini-server. Please see the release notes for full step by step setup and further info - instructions cover both new and existing users.

Any issues, please ask. Any feedback (e.g. anything that isn't clear, etc). Please ask.

Sorry about that Fritz, that was quite likely my bad. I was pretty sure that I tested the full, specific set of instructions, but perhaps not?!

It should be an easy fix though:

mkdir -p /var/lib/dehydrated/acme-challenges

I'll test it in a sec and come back with either a confirmation, or ... In the meantime, I've also added that line to the instructions.

Although when you say:

On the flip side I run confconsole and it's not giving the old errors...

Do you mean that even despite that error, it all still appears to work ok?! FWIW I would have expected it to either "just work" (everywhere), or not at all...

Yep, that was all my fault... TBH, I'm not sure quite what happened there and can only put it down to working too many hours and juggling too many things at once. Deep apologies on leading you astray.

I have just updated both my previous post (above) and the v1.1.1 release notes/instructions with the command that is required.

In your case, this is all you should need:

mkdir -p /var/lib/dehydrated/acme-challenges
/usr/bin/dehydrated --register --accept-terms

Then assuming that you don't already have domains set up, launch confconsole (and select "Advanced" >> "Lets encrypt", etc):

confconsole

Thanks so much for posting with your feedback so quickly. Hopefully we should be all good now.

FWIW, I've just launched a Ghost server with the hope of looking into your Ghost specific issue. Hopefully I'll have something for you on that shortly...

Turns out that it was a bit more involved than I had anticipated. So to try to make the most out of the situation, I decided to post it as a "blog post tutorial"... :)

You can find it here, but be warned it's pretty long... I tested it all on a vanilla v15.3 Ghost appliance, so it should all "just work". Hopefully my rambling. meandering style of writing doesn't make it harder to follow than it needs to be! I sometimes get caught up in trying to explain things and giving the full context and that doesn't always translate to clarity...

Please leave any feedback you have either here and/or in the post comments.

Good luck with it all.