Previously replace_tlsa_records sent separate delete and add requests.
A failure between them would leave the name with no TLSA records. Now
both operations are combined into a single RFC 2136 update message.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HTTP-01 solver with two modes:
- Standalone: embedded hyper HTTP server on configurable address
- Webroot: writes token files for an existing web server
TLS-ALPN-01 solver:
- Embedded rustls TLS server with ALPN "acme-tls/1"
- Dynamic certificate resolution per-identifier
- Self-signed cert with critical acmeIdentifier extension (RFC 8737)
Both solvers use rustls/ring crypto backend (no aws-lc-rs dependency).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Solver trait with present/cleanup/needs_propagation_delay methods
- DNS-01 solver extracted from inline renew.rs code
- ACME module now supports mixed Identifier::Dns + Identifier::Ip
- Generic ChallengeInfo replaces DnsChallenge
- Per-domain challenge type selection based on solver config
- Propagation delay only applied when DNS-01 solvers are in use
- Solver instances deduplicated by name across domains
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Use ring backend for instant-acme instead of aws-lc-rs (fixes Arch
build linker errors, also reduces binary from 9MB to 6.6MB)
- Remove redundant mv in deb packaging (dpkg-deb already outputs the
correct filename)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Enable LTO, single codegen unit, symbol stripping, and panic=abort
in the release profile. Trim tokio features to only what's needed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rust CLI tool for automated ACME certificate management with:
- DNS-01 challenge via RFC 2136 dynamic DNS updates with TSIG auth
- DANE TLSA record publication (RFC 6698/7671/7672)
- systemd credential integration (systemd-creds encrypt/decrypt)
- systemd unit management via D-Bus (zbus)
- Post-renewal hooks (systemctl reload/restart, arbitrary commands)
- Key rotation with DANE pre-publication protocol
- TOML configuration with per-zone DNS overrides
Tested against Let's Encrypt staging. 12 unit tests, zero warnings.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Roman KivalinandClaude Opus 4.6