Roman KivalinandClaude Opus 4.6 a100395097 Only save key when new/rotated, make DANE non-fatal, fix service file ...

- save_key was called on every renewal even when reusing an existing
  key, which caused EROFS errors under ProtectSystem=strict
- Track whether the key is new/rotated via KeyResult.needs_save
- DANE TLSA publication errors are logged but don't prevent hooks
- Remove ProtectSystem=strict and ReadWritePaths from systemd service
  since users can configure arbitrary paths in config
- Add file paths to write error messages for easier diagnosis

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-21 11:19:03 +02:00

..

certforge.service

Only save key when new/rotated, make DANE non-fatal, fix service file

2026-04-21 11:19:03 +02:00

certforge.timer

Initial implementation of certforge ACME certificate manager

2026-04-12 20:07:27 +02:00

config.toml

Add custom file permissions for key and certificate files

2026-04-17 21:03:59 +02:00