@lamalibre/create-lamaste 4.0.0

package/LICENSE.md

@@ -0,0 +1,118 @@
+# License
+
+Copyright (c) 2026 Code Lama Software
+
+## Noncommercial Use
+
+This software is licensed under the [Polyform Noncommercial License 1.0.0](https://polyformproject.org/licenses/noncommercial/1.0.0/).
+
+You may use, copy, modify, and distribute this software for any **noncommercial** purpose. This includes personal projects, academic research, education, and evaluation.
+
+## Commercial Use
+
+Commercial use of this software requires a commercial license, available by contacting license@codelama.com.tr.
+
+Commercial use includes, but is not limited to:
+
+- Using Lamaste in a business to serve data to clients or partners
+- Deploying Lamaste as part of a revenue-generating service or product
+- Using Lamaste internally at a for-profit organization
+
+Sponsorship tiers and terms are listed on our GitHub Sponsors page. Once you become an active sponsor at a qualifying tier, you are granted a commercial use license for the duration of your sponsorship.
+
+## Questions
+
+If you are unsure whether your use qualifies as noncommercial, please open a [GitHub Discussion](https://github.com/lamalibre/lamaste/discussions) or contact us directly.
+
+---
+
+## Polyform Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0/>
+
+### Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+### Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose. However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+### Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software. Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+### Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software. For example:
+
+> Required Notice: Copyright (c) 2026 Code Lama Software (https://github.com/lamalibre/lamaste)
+
+### Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+### Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+### Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+### Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
+
+### Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
+
+### Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+### No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else. These terms do not imply any other licenses.
+
+### Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+### Violations
+
+The first time you are notified in writing that you have violated any of these terms, or any agreement made under them, you have 32 calendar days to come into compliance. If you come into compliance within that time, your licenses under these terms will not be permanently revoked.
+
+### No Liability
+
+**_As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim._**
+
+### Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization. **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise. Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.
+
+---
+
+## Disclaimer
+
+This software is provided "as is", without warranty of any kind, express or implied. The authors and contributors accept no liability for any damages, data loss, security incidents, or legal consequences arising from the use of this software.
+
+Lamaste is designed for self-hosted use cases — personal projects, development environments, demos, and internal tools. It is not a substitute for production infrastructure. Production workloads require dedicated hosting, load balancing, redundancy, monitoring, and operational expertise that are beyond the scope of this project.
+
+**You are solely responsible for what you expose through Lamaste.** By tunneling an application to the public internet, you grant anyone with access the ability to interact with that application as if they were on your local network. This carries inherent risks:
+
+- **Arbitrary code execution:** If the tunneled application contains vulnerabilities or backdoors, remote attackers may exploit them to execute code on your machine, access your file system, or compromise your operating system.
+- **Data exposure:** Misconfigured or insecure applications may leak sensitive data, credentials, or private files to the internet.
+- **Lateral movement:** A compromised tunneled application may be used as an entry point to attack other devices and services on your local network.
+- **Resource abuse:** Publicly accessible applications may be used for cryptocurrency mining, spam relaying, botnet hosting, or other abuse that could result in legal action against you.
+
+Lamaste provides authentication and access control mechanisms, but no security measure is absolute. It is your responsibility to understand the software you expose, keep it updated, and assess the risks of making it publicly accessible. The authors of Lamaste bear no responsibility for the consequences of tunneling untrusted, vulnerable, or malicious software.

package/README.md

@@ -0,0 +1,114 @@
+# @lamalibre/create-lamaste
+
+One-command setup for secure reverse tunnels with a management dashboard.
+
+## Quick Start
+
+```bash
+ssh root@<droplet-ip> "apt install -y npm && npx @lamalibre/create-lamaste"
+```
+
+The installer runs unattended on a fresh Ubuntu 24.04 droplet and provisions
+the full Lamaste stack with zero prompts. When finished it prints:
+
+- An SCP command to download the mTLS client certificate (`.p12`)
+- The p12 password
+- The panel URL (`https://<ip>:9292`)
+
+Import the certificate into your browser and open the URL to begin onboarding.
+
+### JSON Mode
+
+For programmatic use (e.g. from the Lamaste desktop app), pass `--json` to
+replace the interactive Listr2 terminal UI with NDJSON progress lines on stdout:
+
+```bash
+npx @lamalibre/create-lamaste --json
+```
+
+The `--json` flag implies `--yes` (no prompts) and `--dev` (accept private IPs).
+Each line is a JSON object with one of these shapes:
+
+```jsonl
+{"event":"step","step":"check_environment","status":"running"}
+{"event":"step","step":"harden_system","status":"complete"}
+{"event":"step","step":"install_node","status":"skipped"}
+{"event":"complete","server":{"ip":"...","panelUrl":"...","p12Path":"...","p12PasswordPath":"..."}}
+{"event":"error","message":"...","recoverable":false}
+```
+
+## What It Provisions
+
+- **OS hardening** — swap, UFW, fail2ban, SSH lockdown
+- **Node.js 20 LTS**
+- **mTLS PKI** — CA, server cert, client cert + PKCS12 bundle
+- **nginx** — TLS on port 9292 with `ssl_verify_client on`, and a port-80
+  catch-all (`lamalibre-lamaste-http-redirect`) that redirects plain HTTP to
+  HTTPS without getting in the way of Let's Encrypt HTTP-01 challenges
+- **Panel server + client** — systemd service, `lamaste-server` CLI, static
+  frontend, docs and the gatekeeper, in a root-owned `/opt/lamalibre/lamaste`
+  (read-only for the `lamaste` user the panel runs as)
+- **Chisel and Authelia** — the pinned releases (Chisel 1.12.0, Authelia
+  4.39.28) in `/usr/local/bin`, verified against pinned SHA-256 digests before
+  unpacking (a newer installed Authelia is kept, never downgraded), with
+  hardened systemd units. Onboarding only configures and starts them
+- **Service accounts** — the `lamaste-chisel` group (Chisel runs as
+  `nobody:lamaste-chisel`; the panel user is a member so it can write the 0640
+  Chisel authfile without sudo) and the unprivileged `lamaste-authelia` account
+  Authelia runs as
+- **Ownership** — `/var/www/lamaste` (`lamaste:www-data`, setgid), `/etc/authelia`
+  (`lamaste:lamaste-authelia`, setgid), `/var/log/authelia`, the Chisel key
+  and the PKI directory, so the panel manages them without privileges
+- **Root-owned programs** in `/usr/local/sbin/` — `lamaste-priv` (installs the
+  panel's nginx vhosts after checking every directive against an allow-list,
+  stores Authelia TOTP secrets as the Authelia account, starts a self-update),
+  `lamaste-certbot` and `lamaste-cert-info` (certbot / openssl with a fixed
+  argument vector)
+- **Sudoers** — `/etc/sudoers.d/lamaste` with no wildcards: fixed `systemctl`
+  lines, `nginx -t`, and the three programs above. Staged, checked with
+  `visudo -c`, then renamed into place
+
+Re-running the installer on an existing server (redeploy — also what the
+panel's self-update runs) refreshes the panel, CLI, UI, docs and gatekeeper,
+the pinned binaries, the panel, Chisel and Authelia units, the accounts and ownership, the programs and
+sudoers rules, and the port-80 redirect; it removes the retired
+`lamaste-sign-csr` / `lamaste-pki-rename` wrappers and converts an install
+directory left `lamaste`-owned by an older version. Upgrade agents before the
+server.
+
+Domain setup, Chisel tunnels, Authelia, and Let's Encrypt certificates are
+configured through the browser-based onboarding wizard after installation.
+
+## Requirements
+
+| Requirement | Details                 |
+| ----------- | ----------------------- |
+| OS          | Ubuntu 24.04 LTS        |
+| Access      | root                    |
+| Node.js     | >= 20.0.0               |
+| RAM         | 512 MB minimum          |
+| Recommended | DigitalOcean $4 droplet |
+
+## Further Reading
+
+See the main repository for architecture, development plan, and full
+documentation: <https://github.com/lamalibre/lamaste>
+
+## Disclaimer
+
+This software is provided "as is", without warranty of any kind, express or implied. The authors and contributors accept no liability for any damages, data loss, security incidents, or legal consequences arising from the use of this software.
+
+Lamaste is designed for self-hosted use cases — personal projects, development environments, demos, and internal tools. It is not a substitute for production infrastructure. Production workloads require dedicated hosting, load balancing, redundancy, monitoring, and operational expertise that are beyond the scope of this project.
+
+**You are solely responsible for what you expose through Lamaste.** By tunneling an application to the public internet, you grant anyone with access the ability to interact with that application as if they were on your local network. This carries inherent risks:
+
+- **Arbitrary code execution:** If the tunneled application contains vulnerabilities or backdoors, remote attackers may exploit them to execute code on your machine, access your file system, or compromise your operating system.
+- **Data exposure:** Misconfigured or insecure applications may leak sensitive data, credentials, or private files to the internet.
+- **Lateral movement:** A compromised tunneled application may be used as an entry point to attack other devices and services on your local network.
+- **Resource abuse:** Publicly accessible applications may be used for cryptocurrency mining, spam relaying, botnet hosting, or other abuse that could result in legal action against you.
+
+Lamaste provides authentication and access control mechanisms, but no security measure is absolute. It is your responsibility to understand the software you expose, keep it updated, and assess the risks of making it publicly accessible. The authors of Lamaste bear no responsibility for the consequences of tunneling untrusted, vulnerable, or malicious software.
+
+## License
+
+[Polyform Noncommercial 1.0.0](./LICENSE.md) — see [LICENSE.md](./LICENSE.md) for details.

package/bin/create-lamaste.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+
+import { main } from '../src/index.js';
+
+try {
+  await main();
+} catch (error) {
+  console.error('\n');
+  console.error('  Lamaste installation failed.');
+  console.error(`  Error: ${error.message}`);
+  console.error('\n');
+  console.error('  You can safely re-run this installer to retry.');
+  console.error('\n');
+  process.exit(1);
+}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@lamalibre/create-lamaste",
+  "version": "4.0.0",
+  "description": "One-command setup for secure reverse tunnels with a management dashboard",
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "author": "Code Lama Software",
+  "bin": {
+    "create-lamaste": "bin/create-lamaste.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "scripts",
+    "vendor"
+  ],
+  "scripts": {
+    "bundle-vendor": "node scripts/bundle-vendor.js",
+    "lint": "eslint .",
+    "prepack": "node scripts/bundle-vendor.js",
+    "prepublishOnly": "npm run lint",
+    "test": "node --test test/*.test.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lamalibre/lamaste.git",
+    "directory": "packages/provisioners/server"
+  },
+  "homepage": "https://github.com/lamalibre/lamaste#readme",
+  "bugs": {
+    "url": "https://github.com/lamalibre/lamaste/issues"
+  },
+  "keywords": [
+    "tunnel",
+    "reverse-tunnel",
+    "chisel",
+    "nginx",
+    "management",
+    "dashboard",
+    "vps",
+    "self-hosted",
+    "authelia",
+    "mtls"
+  ],
+  "dependencies": {
+    "@lamalibre/lamaste": "^4.0.0",
+    "chalk": "^5.3.0",
+    "execa": "^9.0.0",
+    "listr2": "^8.0.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/scripts/bundle-vendor.js

@@ -0,0 +1,110 @@
+/**
+ * Bundles sibling monorepo packages into vendor/ so that create-lamaste
+ * works standalone when installed via npx (outside the monorepo).
+ *
+ * Runs automatically before every `npm pack` / `npm publish` (the "prepack"
+ * script), so a packed installer never carries a stale vendor/. Progress goes
+ * to stderr: `npm pack --json` prints its JSON on stdout.
+ */
+
+import { cp, mkdir, rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const thisDir = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(thisDir, '..');
+const monorepoRoot = join(packageRoot, '..', '..', '..');
+const vendorDir = join(packageRoot, 'vendor');
+
+async function main() {
+  // Clean vendor/ if it exists, then recreate
+  await rm(vendorDir, { recursive: true, force: true });
+  await mkdir(vendorDir, { recursive: true });
+
+  // --- lamaste-serverd: package.json + src/ ---
+  const serverSrc = join(monorepoRoot, 'packages', 'server', 'daemon');
+  if (!existsSync(serverSrc)) {
+    throw new Error(`lamaste-serverd not found at ${serverSrc}. Run from the monorepo root.`);
+  }
+
+  const serverDest = join(vendorDir, 'serverd');
+  await mkdir(serverDest, { recursive: true });
+  await cp(join(serverSrc, 'package.json'), join(serverDest, 'package.json'));
+  await cp(join(serverSrc, 'src'), join(serverDest, 'src'), {
+    recursive: true,
+  });
+
+  console.error('Bundled vendor/serverd from lamaste-serverd (package.json + src/)');
+
+  // --- lamaste-server: server operational CLI (package.json + bin/ + src/) ---
+  // The 2.0 refactor split the CLI out of the daemon; this CLI owns
+  // `lamaste-server reset-admin` (the recovery path that also supplies the
+  // legacy `lamaste-reset-admin` binary via symlink at install time).
+  const serverCliSrc = join(monorepoRoot, 'packages', 'server', 'cli');
+  if (!existsSync(serverCliSrc)) {
+    throw new Error(`lamaste-server CLI not found at ${serverCliSrc}. Run from the monorepo root.`);
+  }
+  const serverCliDest = join(vendorDir, 'server');
+  await mkdir(serverCliDest, { recursive: true });
+  await cp(join(serverCliSrc, 'package.json'), join(serverCliDest, 'package.json'));
+  await cp(join(serverCliSrc, 'bin'), join(serverCliDest, 'bin'), { recursive: true });
+  await cp(join(serverCliSrc, 'src'), join(serverCliDest, 'src'), { recursive: true });
+  console.error('Bundled vendor/server from lamaste-server CLI (package.json + bin/ + src/)');
+
+  // --- lamaste-server-ui: dist/ (pre-built assets) ---
+  const clientDist = join(monorepoRoot, 'packages', 'server', 'ui', 'dist');
+  if (!existsSync(clientDist)) {
+    throw new Error(
+      `lamaste-server-ui/dist/ not found at ${clientDist}. Run "npm run build" first.`,
+    );
+  }
+
+  const clientDest = join(vendorDir, 'server-ui');
+  await mkdir(join(clientDest, 'dist'), { recursive: true });
+  await cp(clientDist, join(clientDest, 'dist'), { recursive: true });
+
+  console.error('Bundled vendor/server-ui (dist/)');
+
+  // --- gatekeeper: package.json + dist/ (compiled TypeScript) ---
+  const gatekeeperSrc = join(monorepoRoot, 'packages', 'sdks', 'gatekeeper');
+  const gatekeeperDist = join(gatekeeperSrc, 'dist');
+  if (existsSync(gatekeeperDist)) {
+    const gatekeeperDest = join(vendorDir, 'gatekeeper');
+    await mkdir(gatekeeperDest, { recursive: true });
+    await cp(join(gatekeeperSrc, 'package.json'), join(gatekeeperDest, 'package.json'));
+    await cp(gatekeeperDist, join(gatekeeperDest, 'dist'), { recursive: true });
+    console.error('Bundled vendor/gatekeeper (package.json + dist/)');
+  } else {
+    console.error('Skipped vendor/gatekeeper (dist/ not found — run "npm run build" first)');
+  }
+
+  // --- docs: version-stamped markdown ---
+  const docsStampScript = join(
+    monorepoRoot,
+    'packages',
+    'core',
+    'docs',
+    'scripts',
+    'version-stamp.js',
+  );
+  if (existsSync(docsStampScript)) {
+    const docsDest = join(vendorDir, 'docs');
+    execFileSync('node', [docsStampScript, docsDest], {
+      cwd: monorepoRoot,
+      // Progress on stderr: `npm pack --json` (prepack) reads stdout as JSON.
+      stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    console.error('Bundled vendor/docs (version-stamped)');
+  } else {
+    console.error('Skipped vendor/docs (version-stamp script not found)');
+  }
+
+  console.error('Vendor bundling complete.');
+}
+
+main().catch((err) => {
+  console.error(err.message);
+  process.exit(1);
+});

package/scripts/lamaste-cert-info

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+#
+# lamaste-cert-info — root-only, read-only queries about a Let's Encrypt
+# certificate lineage.
+#
+# This script is invoked via sudo from the lamaste service user. It replaces
+# sudoers entries of the form
+#
+#   lamaste ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*
+#
+# whose trailing `*` also matched extra openssl arguments — `-engine <lib.so>`
+# loads a shared object as root, and a traversing path reads any file. Here the
+# lineage name is validated and openssl runs with a fixed argument vector on
+# /etc/letsencrypt/live/<lineage>/fullchain.pem.
+#
+# Usage:
+#   lamaste-cert-info <lineage> enddate     # prints notAfter=<date>
+#   lamaste-cert-info <lineage> checkend    # exit 0 if valid for 24h more, 1 if not
+#   lamaste-cert-info <lineage> san         # prints the subjectAltName extension
+#
+# Exit status 3 means the lineage has no certificate.
+
+set -euo pipefail
+
+OPENSSL=/usr/bin/openssl
+LIVE_DIR=/etc/letsencrypt/live
+
+err() {
+  printf '%s: %s\n' "lamaste-cert-info" "$1" >&2
+  exit 2
+}
+
+hostname_re='^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$'
+
+[[ $# -eq 2 ]] || err "usage: lamaste-cert-info <lineage> enddate|checkend|san"
+lineage="$1"
+query="$2"
+
+if (( ${#lineage} > 253 )) || ! [[ "$lineage" =~ $hostname_re ]]; then
+  err "invalid lineage name: $lineage"
+fi
+
+cert="$LIVE_DIR/$lineage/fullchain.pem"
+if [[ ! -f "$cert" ]]; then
+  printf '%s: no certificate for %s\n' "lamaste-cert-info" "$lineage" >&2
+  exit 3
+fi
+
+case "$query" in
+  enddate)
+    exec "$OPENSSL" x509 -noout -enddate -in "$cert"
+    ;;
+  checkend)
+    exec "$OPENSSL" x509 -noout -checkend 86400 -in "$cert"
+    ;;
+  san)
+    exec "$OPENSSL" x509 -noout -ext subjectAltName -in "$cert"
+    ;;
+  *)
+    err "unknown query: $query"
+    ;;
+esac

package/scripts/lamaste-certbot

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+#
+# lamaste-certbot — root-only wrapper for the Let's Encrypt operations the
+# panel performs.
+#
+# This script is invoked via sudo from the lamaste service user. It replaces
+# sudoers entries of the form
+#
+#   lamaste ALL=(root) NOPASSWD: /usr/bin/certbot certonly --nginx -d * --email * ...
+#   lamaste ALL=(root) NOPASSWD: /usr/bin/certbot renew --cert-name * --non-interactive
+#
+# A sudoers `*` matches any characters, spaces included, so those rules let the
+# lamaste user append arbitrary certbot flags — `--deploy-hook <cmd>`,
+# `--nginx-ctl <binary>`, `--config-dir <dir>` — and run code as root. Here every
+# argument is validated and certbot is executed with a fixed argument vector.
+#
+# Usage:
+#   lamaste-certbot issue <email> <cert-name> <domain> [<domain>...]
+#       certbot certonly --nginx --cert-name <cert-name> -d <domain>... \
+#               --email <email> --agree-tos --non-interactive
+#   lamaste-certbot renew <cert-name> [force]     (never with certbot's random delay)
+#   lamaste-certbot renew-all
+#   lamaste-certbot list
+#
+# Every <domain> and <cert-name> must be a lowercase DNS hostname (no wildcard,
+# no path characters); at most 100 domains, as Let's Encrypt allows.
+
+set -euo pipefail
+
+CERTBOT=/usr/bin/certbot
+
+err() {
+  printf '%s: %s\n' "lamaste-certbot" "$1" >&2
+  exit 2
+}
+
+# A DNS hostname: dot-separated labels of [a-z0-9-], each 1-63 chars, not
+# starting or ending with a hyphen, at least two labels, 253 chars at most.
+hostname_re='^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$'
+# Same rule as LETSENCRYPT_EMAIL_REGEX in @lamalibre/lamaste (onboarding rejects
+# anything this refuses). The local part may not start with '-'.
+email_re="^[A-Za-z0-9][A-Za-z0-9._%+'-]{0,63}@([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+([A-Za-z]{2,63}|xn--[A-Za-z0-9-]{1,59})\$"
+
+check_hostname() {
+  local name="$1"
+  if (( ${#name} > 253 )) || ! [[ "$name" =~ $hostname_re ]]; then
+    err "invalid hostname: $name"
+  fi
+}
+
+[[ $# -ge 1 ]] || err "usage: lamaste-certbot issue|renew|renew-all|list ..."
+cmd="$1"
+shift
+
+case "$cmd" in
+  issue)
+    [[ $# -ge 3 ]] || err "usage: lamaste-certbot issue <email> <cert-name> <domain>..."
+    email="$1"
+    cert_name="$2"
+    shift 2
+    if (( ${#email} > 254 )) || ! [[ "$email" =~ $email_re ]]; then
+      err "invalid email address"
+    fi
+    check_hostname "$cert_name"
+    (( $# <= 100 )) || err "too many domains ($#); at most 100"
+    domain_args=()
+    for domain in "$@"; do
+      check_hostname "$domain"
+      domain_args+=(-d "$domain")
+    done
+    exec "$CERTBOT" certonly --nginx --cert-name "$cert_name" "${domain_args[@]}" \
+      --email "$email" --agree-tos --non-interactive
+    ;;
+  renew)
+    [[ $# -ge 1 && $# -le 2 ]] || err "usage: lamaste-certbot renew <cert-name> [force]"
+    check_hostname "$1"
+    # A non-interactive renew otherwise sleeps up to ~8 minutes first (meant
+    # for certbot.timer); the panel runs these while an operator waits.
+    if [[ $# -eq 2 ]]; then
+      [[ "$2" == "force" ]] || err "the only renew option is 'force'"
+      exec "$CERTBOT" renew --cert-name "$1" --force-renewal --no-random-sleep-on-renew --non-interactive
+    fi
+    exec "$CERTBOT" renew --cert-name "$1" --no-random-sleep-on-renew --non-interactive
+    ;;
+  renew-all)
+    [[ $# -eq 0 ]] || err "renew-all takes no arguments"
+    exec "$CERTBOT" renew --no-random-sleep-on-renew --non-interactive
+    ;;
+  list)
+    [[ $# -eq 0 ]] || err "list takes no arguments"
+    exec "$CERTBOT" certificates --non-interactive
+    ;;
+  *)
+    err "unknown command: $cmd"
+    ;;
+esac