# Certforge configuration
#
# This is a reference configuration. Uncomment and adjust the sections
# below to match your environment. No certificates will be managed
# until at least one [[certificate]] block is uncommented.

[acme]
directory_url = "https://acme-v02.api.letsencrypt.org/directory"
# Use staging for testing:
# directory_url = "https://acme-staging-v02.api.letsencrypt.org/directory"

# ACME account key: stored as encrypted systemd credential
# account_key_credential = "/etc/credstore.encrypted/acme-account-key"
# Or as a plain file:
account_key_path = "/etc/certforge/account.key"

contact = ["mailto:admin@example.com"]

# Default solver for all certificates (can be overridden per-certificate)
# default_solver = "dns"

# DNS client connections — referenced by solvers and DANE blocks
[dns.main]
server = "ns1.example.com"
# Single zone:
zone = "example.com"
# Multiple zones on the same server (longest suffix match):
# zones = ["example.com", "example.org"]
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-key"
tsig_key_path = "/etc/certforge/tsig.key"
tsig_key_name = "certforge."
tsig_algorithm = "hmac-sha256"
port = 53
protocol = "tcp"

# Additional DNS clients (e.g., different server or TSIG key)
# [dns.other]
# server = "ns2.example.org"
# zone = "example.org"
# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-org"
# tsig_key_name = "certforge-org."

# Challenge solvers
[solver.dns]
type = "dns-01"
dns = "main"                    # references [dns.main]
# propagation_delay = 5         # seconds to wait for DNS propagation (default: 5)

# [solver.dns-org]
# type = "dns-01"
# dns = "org"

# [solver.http]
# type = "http-01"
# listen = "[::]:80"            # single address
# # listen = ["[::]:80", "[::]:8080"]  # multiple: try all, succeed if any binds
# # OR: webroot = "/var/www/acme"

# [solver.tls]
# type = "tls-alpn-01"
# listen = "[::]:443"           # single or list like http-01

# Named hooks — run once after all renewals, deduplicated across certificates.
# Hooks run in the order defined here.
# [[hook]]
# name = "reload-postfix"
# type = "systemd-reload"
# unit = "postfix.service"
#
# [[hook]]
# name = "reload-nginx"
# type = "systemd-reload"
# unit = "nginx.service"

# Uncomment and configure certificate blocks below.
#
# [[certificate]]
# name = "mail"
# domains = ["mail.example.com"]
# solver = "dns"
# key_type = "ecdsa-p256"        # ecdsa-p256, ecdsa-p384
# key_credential = "/etc/credstore.encrypted/mail-tls-key"
# # key_path = "/etc/certforge/keys/mail.key"
# # key_mode = "0640"             # file mode (default: 0600)
# # key_owner = "root"            # file owner (default: unchanged)
# # key_group = "postfix"       # file group (default: unchanged)
# cert_path = "/etc/certforge/certs/mail.pem"
# # cert_mode = "0644"            # file mode (default: 0644)
# # cert_owner = "root"
# # cert_group = "postfix"
# renew_before_days = 30
# rotate_key = false
# # Named hooks (deduplicated if multiple certs reference the same hook)
# hooks = ["reload-postfix"]
#
#   # DANE TLSA for SMTP (port 25)
#   [[certificate.dane]]
#   dns = "main"
#   usage = "ee"
#   selector = "spki"
#   matching = "sha256"
#   names = ["_25._tcp.mail.example.com"]
#   ttl = 300
#   pre_publish = true
#
#   # Inline hooks (always run per-certificate, not deduplicated)
#   [[certificate.hook]]
#   type = "systemd-reload"
#   unit = "postfix.service"
#
# # IP address certificate (requires shortlived profile, ~6 day validity)
# [[certificate]]
# name = "dns-server"
# domains = ["dns.example.com", "203.0.113.1", "2001:db8::1"]
# solvers = ["dns", "http", "http"]
# profile = "shortlived"
# renew_before_days = 3
# key_path = "/etc/certforge/keys/dns-server.key"
# cert_path = "/etc/certforge/certs/dns-server.pem"
#
# # Simple certificate using default_solver
# [[certificate]]
# name = "web"
# domains = ["example.com", "www.example.com"]
# key_credential = "/etc/credstore.encrypted/web-tls-key"
# cert_path = "/etc/certforge/certs/web.pem"
#
#   [[certificate.dane]]
#   dns = "main"
#   names = ["_443._tcp.example.com", "_443._tcp.www.example.com"]
#   ttl = 3600
#
#   [[certificate.hook]]
#   type = "systemd-reload"
#   unit = "nginx.service"