From 640d1bbbb762bc590441e70828674a0b2d4e8f45 Mon Sep 17 00:00:00 2001
From: Al West <al@tsew.net>
Date: Wed, 29 Jul 2026 17:28:14 +0100
Subject: [PATCH 1/3] Set LOG_TIMESTAMP format in Dockerfile

Add environment variable for logging timestamp format
---
 letsencrypt/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/letsencrypt/Dockerfile b/letsencrypt/Dockerfile
index 05f554660..9252b13b6 100644
--- a/letsencrypt/Dockerfile
+++ b/letsencrypt/Dockerfile
@@ -4,6 +4,9 @@ FROM $BUILD_FROM
 # Allow pip to install packages system-wide on Debian
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 
+# Log the full date next to the time, bashio defaults to "%T" (time only)
+ENV LOG_TIMESTAMP="%Y-%m-%d %H:%M:%S"
+
 # setup base
 # certbot-dns-multi replaces most individual DNS plugins using lego
 # Only legacy plugins are kept for providers not supported by lego: gehirn, eurodns, noris

From 8a49a0675f0691f5154fdec2d4e2e58ca6383dd3 Mon Sep 17 00:00:00 2001
From: Al West <al@tsew.net>
Date: Wed, 29 Jul 2026 17:31:19 +0100
Subject: [PATCH 2/3] Implement timestamped logging for certbot commands

Added a timestamping function to log certbot output.
---
 letsencrypt/rootfs/etc/services.d/lets-encrypt/run | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/letsencrypt/rootfs/etc/services.d/lets-encrypt/run b/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
index b0b35f910..292618148 100755
--- a/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
+++ b/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
@@ -28,6 +28,15 @@ TEST_CERT=$(bashio::config 'test_cert')
 VERBOSE=$(bashio::config 'verbose')
 FORCE_RENEW=$(bashio::config 'force_renew')
 
+# Prefix each line of a command's output with a timestamp, so certbot's output
+# is dated like the bashio::log messages around it. bashio writes to $LOG_FD,
+# a dup of the original stdout, so this only wraps the given command.
+timestamped() {
+    "$@" 2>&1 | while IFS= read -r line; do
+        printf '[%s] %s\n' "$(date +"${LOG_TIMESTAMP:-%Y-%m-%d %H:%M:%S}")" "${line}"
+    done
+}
+
 # Legacy providers not supported by lego/certbot-dns-multi
 LEGACY_PROVIDERS="dns-eurodns dns-gehirn dns-noris"
 
@@ -636,7 +645,7 @@ if bashio::config.has_value 'eab_kid' ; then
 fi
 
 # Generate a new certificate if necessary or expand a previous certificate if domains has changed
-certbot certonly --non-interactive --keep-until-expiring --expand \
+timestamped certbot certonly --non-interactive --keep-until-expiring --expand \
     --email "$EMAIL" --agree-tos \
     "${KEY_ARGUMENTS[@]}" \
     "${ADDITIONAL_ARGS[@]}" \

From 2935901dcf837b4a4dd9f8d2a4d8602ea2288807 Mon Sep 17 00:00:00 2001
From: Al West <al@tsew.net>
Date: Mon, 3 Aug 2026 15:59:35 +0100
Subject: [PATCH 3/3] Preserve Certbot's exit through timestamped()

---
 letsencrypt/rootfs/etc/services.d/lets-encrypt/run | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/letsencrypt/rootfs/etc/services.d/lets-encrypt/run b/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
index 292618148..d7b6ae855 100755
--- a/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
+++ b/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
@@ -35,6 +35,9 @@ timestamped() {
     "$@" 2>&1 | while IFS= read -r line; do
         printf '[%s] %s\n' "$(date +"${LOG_TIMESTAMP:-%Y-%m-%d %H:%M:%S}")" "${line}"
     done
+    # The while loop always succeeds, so report the wrapped command's status instead.
+    local status="${PIPESTATUS[0]}"
+    return "${status}"
 }
 
 # Legacy providers not supported by lego/certbot-dns-multi