Run fails on prompt during certonly if certs are not yet due for renewal about puppet-letsencrypt

[kwisatz]

There seems to be a specific problem with the config on the host above. On another host were we applied the same changes (from standalone to webroot), the puppet run works fine and it is not attempting to launch letsencrypt-auto:

Notice: /Stage[main]/Profile::Letsencrypt/Letsencrypt::Certonly[icinga.mon.my.domain.tld]/Cron[letsencrypt renew cron icinga.mon.my.domain.tld]/ensure: created

What might be specific about the other host is that at some point – IIRC when we added another domain as a SAN – letsencrypt decided to create new configuration files:

root@loadbalancer:~# ls -l /etc/letsencrypt/renewal/
total 12
-rwxr-xr-x 1 root root 516 Nov 11 12:56 api.my.domain.tld-0001.conf
-rw-r--r-- 1 root root 864 Jan 30 10:49 api.my.domain.tld-0002.conf
-rwxr-xr-x 1 root root 496 Nov  6 22:46 api.my.domain.tld.conf

I don't know what caused it to do so and since this is a production site, I'm not really inclined to too much experimentation.
However, a renewed attempt to do a puppet run resulted in it trying to bootstrap the entire thing again, starting from installing dependencies, etc (although valid certs had been generated in November):

Notice: /Stage[main]/Profile::Letsencrypt/Letsencrypt::Certonly[api.my.domain.tld]/Exec[letsencrypt certonly api.my.domain.tld]/returns: Bootstrapping dependencies for Debian-based OSes...

OK, that last thing seems to be a bug in the letsencrypt-auto script that causes it to not interpret ~ as $HOME but literally.

[kwisatz]

And that seems to be at least part of the problem.
Now that I first moved to /root and executed puppet agent -t from there, all is fine:

Notice: /Stage[main]/Profile::Letsencrypt/Letsencrypt::Certonly[api.my.domain.tld]/Exec[letsencrypt certonly api.my.domain.tld]/returns: executed successfully
Notice: /Stage[main]/Profile::Letsencrypt/Module::Letsencrypt::Dhparam[api.my.domain.tld]/Dhparam[/etc/letsencrypt/live/my.domain.tld/dhparam.pem]/ensure: created
Notice: Finished catalog run in 47.39 seconds

Another point is that it suddenly and for no obvious reason to me decided to use another domain from the array of domains passed to certonly as the first domain.