Roll your TLS certificates without an SSH session

Let's Encrypt certificates expire every 90 days. The traditional renewal lives in a crontab on a server you SSH into to set up, and pray nobody loses the key.

Hoody-cron carries the entry; hoody-exec carries the renewal logic. The schedule is 0 4 * * 0: Sunday 4am. The command curls the exec URL that runs certbot, copies the new cert into place, reloads the service. The whole pipeline is two URLs and a 5-field schedule.

You don't SSH to your server to set this up. You POST to the cron API. You don't SSH to debug it. You curl the exec URL with a --dry-run flag. The auth is the URL token, not a private key in ~/.ssh.

Renewal is a curl on a schedule: no shell session, no key, no jump host.