tls

type ChallengePublisher interface {
	Present(fqdn, value string)
	CleanUp(fqdn, value string)
}

type Manager struct {
	// contains filtered or unexported fields
}

type Options struct {
	// Publisher is where DNS-01 challenges are written — the dns head's
	// ChallengeStore. REQUIRED for issuance to work.
	Publisher ChallengePublisher

	// Email is the ACME account contact (recommended by CAs).
	Email string

	// CA is the ACME directory URL. Empty ⇒ certmagic's default
	// (Let's Encrypt production). Point at LE staging or a local
	// Pebble/step-ca directory for testing.
	CA string

	// CARootFile is a PEM bundle to trust as the ACME CA's root, for a CA
	// whose root isn't in the system pool (Pebble/step-ca). Empty ⇒ system
	// roots — the right default for Let's Encrypt.
	CARootFile string

	// StorageDSN selects the cert/account store; empty ⇒ file at StoragePath.
	// A recognised scheme uses an overlay-registered backend (see storage.go).
	StorageDSN  string
	StoragePath string

	// Resolvers are the DNS servers certmagic uses for zone discovery and
	// DNS-01 propagation checks. Empty ⇒ query the zone's authoritative
	// servers directly (correct in production, where our head is the
	// authority). Point at our own head (e.g. 127.0.0.1:5354) for an
	// offline/localhost solve.
	Resolvers []string

	// PropagationDelay waits before the first propagation check. For a
	// single-node in-process solve the record is visible immediately, so 0
	// is fine; a small delay helps a shared store settle.
	PropagationDelay time.Duration

	Logger *zap.Logger
}