Your issue stems from Certbot attempting to renew all certificates in your configuration, but failing for domains where DNS challenges (or other challenges) are not passing. You want to renew only those certificates that pass the verification challenge—i.e., only the ones that Certbot can successfully verify.

Solution: Renew Only Successfully Verified Certificates

1. Check Which Certificates Can Be Renewed

Certbot does not have a built-in flag to "only renew if the challenge passes," but you can:

• Dry-run renewals to see which domains would succeed before actually renewing.
• Manually specify only the domains that passed in your last successful renewal.

Step 1: Dry-run Renewal

Run a dry-run to see which certificates would pass:

certbot renew --dry-run --nginx-ctl /usr/sbin/nginx

This will simulate the renewal process and show you which domains would succeed.

Step 2: Identify Successfully Verified Domains

From your last successful renewal, you see:

• gitea.lemnoslife.com-0001
• overleaf.lemnoslife.com
• pim.etesync.lemnoslife.com
• server0.lemnoslife.com
• v.lemnoslife.com
• videos.lemnoslife.com

These are the domains that did pass the challenge.

2. Renew Only the Successfully Verified Domains

You can use the --cert-name or --domains flag to target only the certificates you want to renew.

Option A: Use --cert-name

certbot renew --cert-name gitea.lemnoslife.com-0001 --nginx-ctl /usr/sbin/nginx
certbot renew --cert-name overleaf.lemnoslife.com --nginx-ctl /usr/sbin/nginx
certbot renew --cert-name pim.etesync.lemnoslife.com --nginx-ctl /usr/sbin/nginx
certbot renew --cert-name server0.lemnoslife.com --nginx-ctl /usr/sbin/nginx
certbot renew --cert-name v.lemnoslife.com --nginx-ctl /usr/sbin/nginx
certbot renew --cert-name videos.lemnoslife.com --nginx-ctl /usr/sbin/nginx

Option B: Use --domains

If you want to renew all domains in a certificate config file:

certbot renew --domains gitea.lemnoslife.com,v.lemnoslife.com --nginx-ctl /usr/sbin/nginx

(Replace the domains with the ones you want to renew.)

3. Automate the Process

If you want to automate this, you can write a script that:

1. Parses the output of certbot renew --dry-run to identify which certificates would succeed.
2. Only renews those certificates.

Example Script

#!/bin/bash

# Dry-run to get successful domains
successful_domains=(
    "gitea.lemnoslife.com-0001"
    "overleaf.lemnoslife.com"
    "pim.etesync.lemnoslife.com"
    "server0.lemnoslife.com"
    "v.lemnoslife.com"
    "videos.lemnoslife.com"
)

# Renew only the successful domains
for domain in "${successful_domains[@]}"; do
    certbot renew --cert-name "$domain" --nginx-ctl /usr/sbin/nginx
done

Save this as renew_certs.sh, make it executable (chmod +x renew_certs.sh), and run it.

4. Debugging Failed Renewals

For the domains that failed (gitea.lemnoslife.com, gitlab.lemnoslife.com, private.yt.lemnoslife.com), check:

• DNS records: Ensure A and AAAA records exist for all domains.
• Nginx configuration: Ensure Certbot can temporarily modify your Nginx config for the challenge.
• Rate limits: You hit a rate limit for private.yt.lemnoslife.com. Wait before retrying.

5. Automate with Certbot Hooks (Advanced)

You can use Certbot's --pre-hook and --post-hook to run checks before/after renewal, but this is more complex.

Summary Table

Let me know if you want help writing a more sophisticated script or debugging a specific domain!