certforge (0.8.0-1) unstable; urgency=low

  * Fix HTTP-01 and TLS-ALPN-01 solvers hanging on startup

 -- Roman Kivalin <roman@shl.dev>  Thu, 17 Apr 2026 00:00:00 +0000

certforge (0.7.0-1) unstable; urgency=low

  * Custom file permissions for key and certificate files

 -- Roman Kivalin <roman@shl.dev>  Mon, 14 Apr 2026 00:00:00 +0000

certforge (0.6.0-1) unstable; urgency=low

  * Named hooks with per-certificate reference and cross-cert dedup
  * Multiple listen addresses for HTTP-01 and TLS-ALPN-01 solvers
  * Fix inline hooks ignoring --dry-run flag
  * Improve config validation
  * dane-check verifies published TLSA records against expected values
  * Configurable DNS propagation delay per solver

 -- Roman Kivalin <roman@shl.dev>  Mon, 14 Apr 2026 00:00:00 +0000

certforge (0.5.0-1) unstable; urgency=low

  * Support multiple zones per DNS client with automatic zone matching
  * Config validation for domain/DANE zone matching
  * Don't bind systemd-creds to a specific credential name
  * Fix wildcard certificate DNS-01 challenges

 -- Roman Kivalin <roman@shl.dev>  Sun, 13 Apr 2026 22:00:00 +0000

certforge (0.4.0-1) unstable; urgency=low

  * Breaking: configuration format overhauled (named DNS clients, solvers, per-domain solver assignment)
  * Support for HTTP-01 and TLS-ALPN-01 challenge solvers
  * IP address certificates (IPv4 and IPv6)

 -- Roman Kivalin <roman@shl.dev>  Sat, 12 Apr 2026 23:00:00 +0000

certforge (0.3.0-1) unstable; urgency=low

  * Add DNS propagation delay before ACME challenge validation

 -- Roman Kivalin <roman@shl.dev>  Sat, 12 Apr 2026 22:30:00 +0000

certforge (0.2.0-1) unstable; urgency=low

  * Build on Ubuntu 22.04 for glibc 2.35 compatibility (Debian 12+)

 -- Roman Kivalin <roman@shl.dev>  Sat, 12 Apr 2026 22:00:00 +0000

certforge (0.1.0-1) unstable; urgency=low

  * Initial release.
  * ACME certificate issuance and renewal via DNS-01 challenges (RFC 8555)
  * RFC 2136 dynamic DNS updates with TSIG authentication
  * DANE TLSA record publication (RFC 6698/7671/7672)
  * Key rotation with DANE pre-publication protocol
  * ECDSA P-256 and P-384 key generation
  * systemd credential integration (systemd-creds encrypt/decrypt)
  * systemd unit reload/restart hooks via D-Bus
  * TOML configuration with per-zone DNS overrides
  * Systemd service and timer units included

 -- Roman Kivalin <roman@shl.dev>  Sat, 12 Apr 2026 18:00:00 +0000
