certbot-nginx-unit 1.0.0__py3-none-any.whl

certbot_nginx_unit/__init__.py

@@ -0,0 +1 @@
+"""Certbot nginx unit plugin."""

certbot_nginx_unit/configurator.py

@@ -0,0 +1,362 @@
+"""Nginx Unit Certbot plugins.
+
+Authenticate and Install new o renewed certificates on Nginx Unit
+Authenticator is built on Certbot Webroot giant shoulders
+
+"""
+import collections
+import json
+import logging
+from datetime import datetime
+
+from typing import Any, Callable, Optional, List, Union, Iterable, DefaultDict, Set, Type
+
+from acme import challenges
+from certbot import errors
+from certbot import interfaces
+from certbot.achallenges import AnnotatedChallenge
+from certbot.compat import filesystem
+from certbot.compat import os
+from certbot.display import util as display_util
+from certbot.plugins import common
+from certbot.plugins.util import get_prefixes
+from certbot.util import safe_open
+
+from .unitc import Unitc
+
+CONFIG_TLS_CERTIFICATE_PATH = "/listeners/*:443/tls/certificate"
+
+logger = logging.getLogger(__name__)
+
+
+class Configurator(common.Installer, interfaces.Authenticator):
+    """Nginx Unit certificate authenticator and installer plugin for Certbot"""
+
+    description = """\
+    Nginx Unit certificate installer plugin for Certbot: \
+    saves the necessary validation files to a .well-known/acme-challenge/ directory within the \
+    nominated webroot path. Nginx Unit server must be running. \
+    HTTP challenge only (wildcards not supported)."""
+
+    MORE_INFO = """\
+    Authenticator plugin that performs http-01 challenge by saving
+    necessary validation resources to appropriate paths on the file
+    system. It expects that there is some other HTTP server configured
+    to serve all files under specified web root ({0})."""
+
+    def __init__(self, *args: Any, **kwargs: Any):
+        super().__init__(*args, **kwargs)
+        self._configuration = None
+        self.unitc = Unitc()
+        self._entropy = datetime.now().strftime("%Y%m%d%H%M%S")
+
+        self._challenge_path: str = ""
+        self._full_root: str = ""
+        self._performed: DefaultDict[str, Set[AnnotatedChallenge]] = collections.defaultdict(set)
+        self._created_dirs: List[str] = []
+
+    def get_all_names(self) -> Iterable[str]:
+        return []
+
+    def deploy_cert(self, domain: str, cert_path: str, key_path: str, chain_path: str, fullchain_path: str) -> None:
+        """Deploy certificate.
+
+        :param str domain: domain to deploy certificate file
+        :param str cert_path: absolute path to the certificate file
+        :param str key_path: absolute path to the private key file
+        :param str chain_path: absolute path to the certificate chain file
+        :param str fullchain_path: absolute path to the certificate fullchain
+            file (cert plus chain)
+
+        :raises .PluginError: when cert cannot be deployed
+
+        """
+        logger.debug("deploy cert for domain: %s", domain)
+
+        cert_bundle_name = domain + "_" + self._entropy
+        self._upload_certificates(fullchain_path, key_path, cert_bundle_name)
+
+        certificates_chains = self._get_unit_configuration("/certificates")
+
+        old_certificate_bundle_names = []
+        for bundle_name, certificate in certificates_chains.items():
+            for chain in certificate["chain"]:
+                # @todo check validity chain["validity"]["until"]?
+                if bundle_name == cert_bundle_name or chain["subject"]["common_name"] != domain:
+                    continue
+                old_certificate_bundle_names.append(bundle_name)
+
+        if self._configuration is None:
+            self._configuration = self._get_unit_configuration("/config")
+        self._update_certificate_name_list_to_config(cert_bundle_name, old_certificate_bundle_names)
+
+        display_util.notify(f"Remove old certificates for {domain}")
+        for old_bundle_name in old_certificate_bundle_names:
+            self._delete_certificates(old_bundle_name)
+
+    def _upload_certificates(self, fullchain_path: str, key_path: str, cert_bundle_name: str):
+        certificates = self._get_certificates_content(fullchain_path, key_path)
+        path = "/certificates/" + cert_bundle_name
+        success_message = "Certificate deployed"
+        error_message = "nginx unit copy to /certificates failed"
+        self.unitc.put(path, certificates, success_message, error_message)
+
+    def _delete_certificates(self, cert_bundle_name: str):
+        path = "/certificates/" + cert_bundle_name
+        success_message = "Certificate deleted"
+        error_message = "nginx unit delete from /certificates failed"
+        self.unitc.delete(path, None, success_message, error_message)
+
+    def _update_certificate_name_list_to_config(self, cert_bundle_name: str, bundle_names_to_remove):
+        self._ensure_tls_listener()
+
+        cert_bundle_names = self._configuration["listeners"]["*:443"]["tls"]["certificate"]
+        cert_bundle_names = [item for item in cert_bundle_names if item not in bundle_names_to_remove]
+        cert_bundle_names.append(cert_bundle_name)
+        self._configuration["listeners"]["*:443"]["tls"]["certificate"] = cert_bundle_names
+
+        path = "/config/listeners"
+        input_data = json.dumps(self._configuration["listeners"]).encode()
+        success_message = "Certificate deployed"
+        error_message = "nginx unit copy to /certificates failed"
+
+        self.unitc.put(path, input_data, success_message, error_message)
+
+    def _ensure_tls_listener(self):
+        if "listeners" not in self._configuration:
+            raise errors.PluginError("No listeners configured")
+        if "*:443" not in self._configuration["listeners"]:
+            if "*:80" not in self._configuration["listeners"]:
+                raise errors.PluginError("No '*:80' default listeners configured")
+            self._configuration["listeners"]["*:443"] = self._configuration["listeners"]["*:80"]
+            new_route = self._ensure_acme_route(self._configuration["listeners"]["*:443"]["pass"])
+            self._configuration["listeners"]["*:80"] = {"pass": new_route}
+
+        if "tls" not in self._configuration["listeners"]["*:443"]:
+            self._configuration["listeners"]["*:443"]["tls"] = {}
+        if "certificate" not in self._configuration["listeners"]["*:443"]["tls"]:
+            self._configuration["listeners"]["*:443"]["tls"]["certificate"] = []
+
+    def _ensure_challenge_listener(self):
+        if "listeners" not in self._configuration:
+            raise errors.PluginError("No listeners configured")
+        if "*:80" not in self._configuration["listeners"]:
+            raise errors.PluginError("No '*:80' default listeners configured")
+        if "pass" not in self._configuration["listeners"]["*:80"]:
+            raise errors.PluginError("Cannot configure the route for the *:80 listener")
+
+        actual_route = self._configuration["listeners"]["*:80"]["pass"]
+        default_route = self._ensure_acme_route(actual_route)
+        if actual_route == default_route:
+            return
+
+        self._configuration["listeners"]["*:80"]["pass"] = default_route
+        success_message = "Updated listener for acme challenge"
+        error_message = "Update listener for acme challenge failed"
+        listener_route = "/config/listeners/*:80/pass"
+        self.unitc.put(listener_route, default_route.encode(), success_message, error_message)
+
+    def _ensure_acme_route(self, actual_route: str) -> str:
+        acme_challenge_url = "/.well-known/acme-challenge/*"
+        acme_base_path = "/srv/www/unit"
+        acme_route = [
+            {
+                "match": {"uri": acme_challenge_url},
+                "action": {"share": acme_base_path + "/$uri"},
+            }
+        ]
+        if actual_route != "routes" and actual_route != "routes/acme":
+            acme_route.append({"pass": actual_route})
+
+        acme_route_json = json.dumps(acme_route)
+
+        if "routes" not in self._configuration or not self._configuration["routes"]:
+            self._configuration["routes"] = acme_route
+            self.unitc.put("/config/routes", acme_route_json.encode())
+            return "routes"
+
+        if isinstance(self._configuration["routes"], dict):
+            if "acme" in self._configuration["routes"]:
+                return "routes/acme"
+
+            self._configuration["routes"]["acme"] = acme_route
+            self.unitc.put("/config/routes/acme", acme_route_json.encode())
+            return "routes/acme"
+
+        if not isinstance(self._configuration["routes"], list):
+            raise errors.PluginError("Cannot configure the routes: unknown route type")
+
+        if not isinstance(self._configuration["routes"][0], dict):
+            raise errors.PluginError("Cannot configure the routes: unknown route[0] type")
+
+        first_route = self._configuration["routes"][0]
+        if "match" in first_route and "uri" in first_route["match"] and first_route["match"][
+            "uri"] == acme_challenge_url:
+            return "routes"
+
+        routes = acme_route + self._configuration["routes"]
+        self._configuration["routes"] = routes
+        self.unitc.put("/config/routes", json.dumps(routes).encode())
+        return "routes"
+
+    @staticmethod
+    def _get_certificates_content(fullchain_path, key_path):
+        with open(key_path, "rb") as f:
+            certificates = f.read()
+        with open(fullchain_path, "rb") as f:
+            certificates += f.read()
+        return certificates
+
+    def _get_unit_configuration(self, path: str):
+        error_message = "nginx unit get configuration failed"
+        configuration_str = self.unitc.get(path, "Get configuration", error_message)
+
+        # @todo wrap configuration to a dedicated class
+        return json.loads(configuration_str)
+
+    def enhance(self, domain: str, enhancement: str, options: Optional[Union[List[str], str]] = None) -> None:
+        pass
+
+    def supported_enhancements(self) -> List[str]:
+        return []
+
+    def save(self, title: Optional[str] = None, temporary: bool = False) -> None:
+        pass
+
+    def rollback_checkpoints(self, rollback: int = 1) -> None:
+        pass
+
+    def recovery_routine(self) -> None:
+        pass
+
+    def config_test(self) -> None:
+        pass
+
+    def restart(self) -> None:
+        pass
+
+    def prepare(self) -> None:
+        """Prepare the authenticator/installer."""
+        # @todo verify "unitc" executable
+        # @todo lock to prevent concurrent multi update
+        self._configuration = self._get_unit_configuration("/config")
+
+    def more_info(self) -> str:  # pylint: disable=missing-function-docstring
+        return self.MORE_INFO.format(self.conf("path"))
+
+    ### Authenticator
+    @classmethod
+    def add_parser_arguments(cls, add: Callable[..., None]) -> None:
+        add("path", default=['/srv/www/unit/'],
+            help="public_html / webroot path. Only one catch 'em all temporary "
+                 "directory --nginx-unit-path /srv/www/unit/ (default: /srv/www/unit/)")
+
+    def get_chall_pref(self, domain: str) -> Iterable[Type[challenges.Challenge]]:
+        # pylint: disable=unused-argument,missing-function-docstring
+        return [challenges.HTTP01]
+
+    def perform(self, achalls: List[AnnotatedChallenge]) -> List[
+        challenges.ChallengeResponse]:  # pylint: disable=missing-function-docstring
+
+        self._set_webroot(achalls)
+        self._create_challenge_dir()
+
+        self._ensure_challenge_listener()
+
+        return [self._perform_single(achall) for achall in achalls]
+
+    def _set_webroot(self, achalls: Iterable[AnnotatedChallenge]) -> None:
+        webroot_path = '/srv/www/unit/'
+        if self.conf("path"):
+            webroot_path = self.conf("path")[-1]
+
+        logger.info("Using the webroot path %s for all domains.", webroot_path)
+
+        if not os.path.isdir(webroot_path):
+            raise errors.PluginError(
+                "You should specify the webroot path (or temporary directory) '" +
+                webroot_path + "' does not exist or is not a directory")
+
+        self._challenge_path = os.path.abspath(webroot_path)
+
+    def _create_challenge_dir(self) -> None:
+        if not self._challenge_path:
+            raise errors.PluginError(
+                "Missing parts of nginx_unit plugin configuration.")
+
+        self._full_root = os.path.join(self._challenge_path, os.path.normcase(challenges.HTTP01.URI_ROOT_PATH))
+        logger.debug("Creating root challenges validation dir at %s", self._full_root)
+
+        # Change the permissions to be writable (certbot GH #1389)
+        # Umask is used instead of chmod to ensure the client can also
+        # run as non-root (certbot GH #1795)
+        old_umask = filesystem.umask(0o022)
+        try:
+            # We ignore the last prefix in the next iteration,
+            # as it does not correspond to a folder path ('/' or 'C:')
+            for prefix in sorted(get_prefixes(self._full_root)[:-1], key=len):
+                if os.path.isdir(prefix):
+                    # Don't try to create directory if it already exists, as some filesystems
+                    # won't reliably raise EEXIST or EISDIR if directory exists.
+                    continue
+                try:
+                    # Set owner as parent directory if possible, apply mode for Linux/Windows.
+                    # For Linux, this is coupled with the "umask" call above because
+                    # os.mkdir's "mode" parameter may not always work:
+                    # https://docs.python.org/3/library/os.html#os.mkdir
+                    filesystem.mkdir(prefix, 0o755)
+                    self._created_dirs.append(prefix)
+                    try:
+                        filesystem.copy_ownership_and_apply_mode(
+                            self._challenge_path, prefix, 0o755, copy_user=True, copy_group=True)
+                    except (OSError, AttributeError) as exception:
+                        logger.warning("Unable to change owner and uid of webroot directory")
+                        logger.debug("Error was: %s", exception)
+                except OSError as exception:
+                    raise errors.PluginError(
+                        "Couldn't create root for http-01 "
+                        "challenge responses: {0}".format(exception))
+        finally:
+            filesystem.umask(old_umask)
+
+    def _get_validation_path(self, root_path: str, achall: AnnotatedChallenge) -> str:
+        return os.path.join(root_path, achall.chall.encode("token"))
+
+    def _perform_single(self, achall: AnnotatedChallenge) -> challenges.ChallengeResponse:
+        response, validation = achall.response_and_validation()
+
+        root_path = self._full_root
+        validation_path = self._get_validation_path(root_path, achall)
+        logger.debug("Attempting to save validation to %s", validation_path)
+
+        # Change permissions to be world-readable, owner-writable (certbot GH #1795)
+        old_umask = filesystem.umask(0o022)
+        try:
+            with safe_open(validation_path, mode="wb", chmod=0o644) as validation_file:
+                validation_file.write(validation.encode())
+        finally:
+            filesystem.umask(old_umask)
+
+        self._performed[root_path].add(achall)
+        return response
+
+    def cleanup(self, achalls: List[AnnotatedChallenge]) -> None:  # pylint: disable=missing-function-docstring
+        for achall in achalls:
+            root_path = self._full_root
+            if root_path is not None:
+                validation_path = self._get_validation_path(root_path, achall)
+                logger.debug("Removing %s", validation_path)
+                os.remove(validation_path)
+                self._performed[root_path].remove(achall)
+
+        not_removed: List[str] = []
+        while self._created_dirs:
+            path = self._created_dirs.pop()
+            try:
+                os.rmdir(path)
+            except OSError as exc:
+                not_removed.insert(0, path)
+                logger.info("Challenge directory %s was not empty, didn't remove", path)
+                logger.debug("Error was: %s", exc)
+        self._created_dirs = not_removed
+        logger.debug("All challenges cleaned up")

certbot_nginx_unit/tests/__init__.py

@@ -0,0 +1 @@
+"""certbot-nginx-unit tests"""

certbot_nginx_unit/tests/configurator_test.py

@@ -0,0 +1,195 @@
+"""Test for certbot_nginx.installer."""
+import json
+import tempfile
+
+from unittest import mock
+
+from certbot import errors
+from certbot.compat import os
+from certbot.tests import util as test_util
+from certbot_nginx_unit.configurator import Configurator
+
+
+def empty_configuration():
+    return {
+        "listeners": {},
+        "routes": [],
+        "applications": {}
+    }
+
+
+def only_80_listener_configuration():
+    return {
+        "listeners": {
+            "*:80": {
+                "pass": "routes"
+            }
+        },
+        "routes": [
+            {
+                "action": {
+                    "share": "/srv/www/unit/index.html"
+                }
+            }
+        ]
+    }
+
+
+def only_80_app_listener_configuration():
+    return {
+        "listeners": {
+            "*:80": {
+                "pass": "applications/dokuwiki"
+            }
+        },
+        "routes": [],
+        "application": {
+            "dokuwiki": {
+                "type": "php",
+                "root": "/path/to/app/",
+                "index": "doku.php"
+            }
+        }
+    }
+
+
+def only_80_listener_configuration_after_cert_list():
+    return {
+        "listeners": {
+            "*:80": {"pass": "routes/acme"},
+            "*:443": {"pass": "routes/default"}
+        },
+        "routes": [
+            {
+                "match": {"uri": "/.well-known/acme-challenge/*"},
+                "action": {"share": "/srv/www/unit/$uri"},
+            },
+            {
+                "action": {"share": "/srv/www/unit/index.html"}
+            }
+        ]
+    }
+
+
+def only_80_listener_configuration_after_cert_dictionary():
+    return {
+        "listeners": {
+            "*:80": {"pass": "routes/acme"},
+            "*:443": {"pass": "routes/default"}
+        },
+        "routes": {
+            "acme": {
+                "match": {"uri": "/.well-known/acme-challenge/*"},
+                "action": {"share": "/srv/www/unit/$uri"},
+            },
+            "default": {
+                "action": {"share": "/srv/www/unit/index.html"}
+            }
+        }
+    }
+
+
+def get_configuration_side_effect(*args):
+    if args[0] == "/config":
+        return json.dumps(empty_configuration())
+    if args[0] == "/certificates":
+        return '{}'
+    return 'invalid json'
+
+
+def get_configuration_side_effect_80_listener(*args):
+    if args[0] == "/config":
+        return json.dumps(only_80_listener_configuration())
+    if args[0] == "/certificates":
+        return '{}'
+    return 'invalid json'
+
+
+def put_configuration_side_effect_80_listener(*args):
+    if args[0] == "/config/listeners":
+        return json.dumps(only_80_listener_configuration()['listeners'])
+
+    return '{}'
+
+
+class ConfiguratorTest(test_util.ConfigTestCase):
+    """Test for certbot_nginx.configutator"""
+
+    def setUp(self):
+        super().setUp()
+
+        self.configuration = self.config
+        self.config = None
+        logs_dir = tempfile.mkdtemp('logs')
+        self.config = self.get_nginx_unit_configurator(logs_dir)
+
+    def get_nginx_unit_configurator(self, logs_dir):
+        """Create a Configurator with the specified options."""
+
+        backups = os.path.join(logs_dir, "backups")
+        self.configuration.backup_dir = backups
+
+        return Configurator(self.configuration, name="nginx_unit")
+
+    @mock.patch('certbot_nginx_unit.unitc')
+    def test_empty_configuration(self, unitc_mock):
+        unitc_mock.get.side_effect = get_configuration_side_effect
+
+        installer = self.config
+        installer.unitc = unitc_mock
+        installer.prepare()
+
+        with tempfile.NamedTemporaryFile() as cert_file:
+            assert [] == installer.get_all_names()
+            with self.assertRaises(errors.PluginError) as ctx:
+                installer.deploy_cert("domain", "cert.pem", cert_file.name, "chain_path", cert_file.name)
+
+            expected_msg = "No '*:80' default listeners configured"
+            self.assertEquals(str(ctx.exception), expected_msg)
+
+    @mock.patch('certbot_nginx_unit.unitc')
+    def test_only_80_listener_configuration(self, unitc_mock):
+        unitc_mock.get.side_effect = get_configuration_side_effect_80_listener
+        unitc_mock.put.side_effect = put_configuration_side_effect_80_listener
+
+        installer = self.config
+        installer.unitc = unitc_mock
+        installer.prepare()
+
+        notify = mock.patch('certbot.display.util.notify')
+        notify.start()
+
+        with tempfile.NamedTemporaryFile() as cert_file:
+            cert_file.write('certificate content'.encode())
+            cert_file.seek(0)
+            assert [] == installer.get_all_names()
+            installer.deploy_cert("domain", "cert.pem", cert_file.name, "chain_path", cert_file.name)
+
+        get_success_message = 'Get configuration'
+        get_error_message = 'nginx unit get configuration failed'
+
+        put_success_message = 'Certificate deployed'
+        put_error_message = 'nginx unit copy to /certificates failed'
+
+        entropy = installer._entropy
+
+        unitc_mock.get.assert_any_call("/config", get_success_message, get_error_message)
+        unitc_mock.get.assert_any_call('/certificates', get_success_message, get_error_message)
+        unitc_mock.put.assert_any_call(
+            "/certificates/domain_" + entropy,
+            b'certificate contentcertificate content',
+            'Certificate deployed',
+            'nginx unit copy to /certificates failed'
+        )
+        unitc_mock.put.assert_any_call(
+            '/config/routes',
+            b'[{"match": {"uri": "/.well-known/acme-challenge/*"}, "action": {"share": "/srv/www/unit/$uri"}}, {"action": {"share": "/srv/www/unit/index.html"}}]'
+        )
+        unitc_mock.put.assert_any_call(
+            '/config/listeners',
+            b'{"*:80": {"pass": "routes"}, "*:443": {"pass": "routes", "tls": {"certificate": ["domain_' + entropy.encode() + b'"]}}}',
+            put_success_message,
+            put_error_message
+        )
+
+        notify.stop()

certbot_nginx_unit/unitc.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import tempfile
+import subprocess
+import logging
+from certbot import errors
+from certbot import util
+from certbot.display import util as display_util
+
+logger = logging.getLogger(__name__)
+
+
+class Unitc(object):
+    def call(self, method: str, path: str, input_data: bytes | None = None,
+             success_message: str = "", error_message: str = "") -> str:
+        output = ""
+        with tempfile.TemporaryFile() as out:
+            try:
+                params = ["unitc", method, path]
+                logger.debug("Unic params: %s", " ".join(params))
+                proc = subprocess.run(params,
+                                      env=util.env_no_snap_for_external_calls(),
+                                      input=input_data,
+                                      stdout=out, stderr=out, check=False)
+            except (OSError, ValueError):
+                msg = "Unable to run the command: %s" + " ".join(params)
+                logger.error(msg)
+                raise errors.SubprocessError(msg)
+
+            out.seek(0)
+            output = out.read().decode("utf-8")
+            logger.debug("unic /certificate: %s", output)
+        # @todo from json check if error
+        if proc.returncode != 0 or '"error"' in output:
+            raise errors.Error(error_message)
+        else:
+            display_util.notify(success_message)
+
+        return output
+
+    def get(self, path: str, success_message: str = "", error_message: str = "") -> str:
+        return self.call("GET", path, None, success_message, error_message)
+
+    def put(self, path: str, input_data: bytes | None = None, success_message: str = "", error_message: str = ""):
+        self.call("PUT", path, input_data, success_message, error_message)
+
+    def delete(self, path: str, input_data: bytes | None = None, success_message: str = "", error_message: str = ""):
+        self.call("DELETE", path, input_data, success_message, error_message)

certbot_nginx_unit-1.0.0.dist-info/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Manuel Baldassarri
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

certbot_nginx_unit-1.0.0.dist-info/METADATA

@@ -0,0 +1,180 @@
+Metadata-Version: 2.1
+Name: certbot-nginx-unit
+Version: 1.0.0
+Summary: Nginx Unit plugin for Certbot
+Author-email: Manuel Baldassarri <m.baldassarri@gmail.com>
+License: MIT License
+        
+        Copyright (c) 2024 Manuel Baldassarri
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+Project-URL: Homepage, https://github.com/kea/certbot-nginx-unit
+Project-URL: Issues, https://github.com/kea/certbot-nginx-unit/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: Security :: Cryptography
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Plugins
+Classifier: Operating System :: OS Independent
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest ; extra == 'test'
+
+Certbot NGINX Unit plugin
+=========================
+
+This is a certbot plugin for using certbot in combination with NGINX Unit https://unit.nginx.org/
+
+Requirement
+===========
+The command `unitc` should be installed and executable. 
+
+Current Features
+=====================
+
+* Supports NGINX Unit/1.31*
+* Supports cerbot 1.21+
+* install certificates
+* automatic renewal certificates
+
+Install
+=======
+
+You have to install the plugin and configure the unit listener for port 80
+
+```
+# unitc /config
+```
+```
+{
+    "listeners": {
+        "*:80": {
+            "pass": "routes"
+        }
+        "routes": [
+            {
+                "action": {
+                    "share": "/srv/www/unit/index.html"
+                }
+            }
+        ]
+    }
+}
+```
+
+Now, you can generate and automatically install the certificate with
+
+```
+# certbot --configurator nginx_unit -d www.myapp.com
+```
+
+The result is a certificate created and installed. 
+
+```
+# unitc /certificates
+```
+
+```
+{
+	"www.myapp.com_20240202145800": {
+		"key": "RSA (2048 bits)",
+		"chain": [
+			{
+			    <omissis>
+			}
+        ]
+    }
+}
+```
+and the configuration updated
+
+```
+# unitc /config
+```
+
+```
+{
+	"listeners": {
+		"*:80": {
+			"pass": "routes"
+		},
+
+		"*:443": {
+			"pass": "routes",
+			"tls": {
+				"certificate": [
+					"www.myapp.com_20240202145800"
+				]
+			}
+		}
+	},
+
+	"routes": [
+		{
+			"match": {
+				"uri": "/.well-known/acme-challenge/*"
+			},
+
+			"action": {
+				"share": "/srv/www/unit/$uri"
+			}
+		},
+		{
+			"action": {
+				"share": "/srv/www/unit/index.html"
+			}
+		}
+	]
+}
+```
+
+Auto-renew certificates
+=======================
+
+Certbot installs a timer on the system to renew certificates one month before the certificate expiration date.
+
+Multiple domains/applications
+=============================
+
+You can run the certbot command for each domain
+
+```
+# certbot --configurator nginx_unit -d www.myapp1.com
+# certbot --configurator nginx_unit -d www.myapp2.com
+# unitc '/config/listeners/*:443' 
+```
+
+```
+{
+    "pass": "routes",
+    "tls": {
+        "certificate": [
+            "www.myapp1.com_20240202145800"
+            "www.myapp2.com_20240202145800"
+        ]
+    }
+}
+```
+

certbot_nginx_unit-1.0.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+certbot_nginx_unit/__init__.py,sha256=RgQE2Iv5Pb2y1Ob9pBDQ7AkfB2PDVhDmcynKRXZ3rVs,33
+certbot_nginx_unit/configurator.py,sha256=y21SJEitifiMKAxLcZqw95DhP71oE0w1aNdP37hbkPc,15985
+certbot_nginx_unit/unitc.py,sha256=X6ugHstfiuWA7RPpklmTWufp1MSiRnWsMABRNfzjvpk,1965
+certbot_nginx_unit/tests/__init__.py,sha256=3nPrmfr4Kvv0Rn_LmkHveOeel2yLcQWHJwJCLzetMzQ,31
+certbot_nginx_unit/tests/configurator_test.py,sha256=Qu3z7bE5gnxbdEvx0FcZ3zXOnIGfVSINagGLeuwgKN0,5967
+certbot_nginx_unit-1.0.0.dist-info/LICENSE,sha256=YkZm3khKtc5NRDfdVIFK6L1v08VWgv3oyX0QmBFqwgo,1074
+certbot_nginx_unit-1.0.0.dist-info/METADATA,sha256=8Jm-i8xxenBslVgHsnhkOyXcszEMgnlGYugYtscsuVs,4350
+certbot_nginx_unit-1.0.0.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+certbot_nginx_unit-1.0.0.dist-info/entry_points.txt,sha256=O5eQe444A_eo4Bfk5jM3WMF2YhFjgZRpNG7Pst7jWNk,76
+certbot_nginx_unit-1.0.0.dist-info/top_level.txt,sha256=8LDq2rRhZLXn2-IFroYXkRXYqYrqgkPkJghUUbDrnr8,19
+certbot_nginx_unit-1.0.0.dist-info/RECORD,,

certbot_nginx_unit-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: bdist_wheel (0.42.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

certbot_nginx_unit-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[certbot.plugins]
+nginx_unit = certbot_nginx_unit.configurator:Configurator

certbot_nginx_unit-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+certbot_nginx_unit