devnomads-cli 0.7.0__tar.gz → 0.8.0__tar.gz

{devnomads_cli-0.7.0 → devnomads_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.7.0
+Version: 0.8.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -11,7 +11,7 @@ Requires-Dist: typer>=0.12
 Requires-Dist: httpx>=0.27
 Requires-Dist: rich>=13
 Requires-Dist: cryptography>=42
-Requires-Dist: devnomads[acme]>=0.2.5
+Requires-Dist: devnomads[acme]>=0.5.0
 Dynamic: license-file
 
 # dncli

{devnomads_cli-0.7.0 → devnomads_cli-0.8.0}/devnomads_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.7.0
+Version: 0.8.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -11,7 +11,7 @@ Requires-Dist: typer>=0.12
 Requires-Dist: httpx>=0.27
 Requires-Dist: rich>=13
 Requires-Dist: cryptography>=42
-Requires-Dist: devnomads[acme]>=0.2.5
+Requires-Dist: devnomads[acme]>=0.5.0
 Dynamic: license-file
 
 # dncli

{devnomads_cli-0.7.0 → devnomads_cli-0.8.0}/devnomads_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12
 httpx>=0.27
 rich>=13
 cryptography>=42
-devnomads[acme]>=0.2.5
+devnomads[acme]>=0.5.0

{devnomads_cli-0.7.0 → devnomads_cli-0.8.0}/dncli.py

@@ -52,7 +52,7 @@ from rich.markup import escape
 from rich.table import Table
 from typer.core import TyperGroup
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"
 
 # Distribution names, for reporting versions via `dncli version`.
 CLI_PACKAGE = "devnomads-cli"
@@ -1785,6 +1785,18 @@ class KeyType(str, Enum):
     rsa4096 = "rsa4096"
 
 
+class PreferredChain(str, Enum):
+    """Terminating root to pin the served certificate chain to (Let's Encrypt).
+
+    This only selects which offered chain is served, not the certificate
+    itself. `ISRG Root X1` gives the broadest compatibility with older clients;
+    the ECDSA-only `ISRG Root X2` chain is smaller but needs a post-2022 trust
+    store. Left unset, the CA's default chain is used unchanged."""
+
+    isrg_root_x1 = "ISRG Root X1"
+    isrg_root_x2 = "ISRG Root X2"
+
+
 class ExportFormat(str, Enum):
     """Bundle formats for `cert export`."""
 
@@ -1799,6 +1811,18 @@ ProviderOption = Annotated[
         help="ACME certificate authority: letsencrypt (default) or zerossl.",
     ),
 ]
+PreferredChainOption = Annotated[
+    PreferredChain | None,
+    typer.Option(
+        "--preferred-chain",
+        help=(
+            "Pin the served chain to this terminating root (Let's Encrypt): "
+            "'ISRG Root X1' for the broadest old-client compatibility, or "
+            "'ISRG Root X2' for the smaller ECDSA-only chain. Unset keeps the "
+            "CA default."
+        ),
+    ),
+]
 EabKidOption = Annotated[
     str | None,
     typer.Option(
@@ -2069,6 +2093,7 @@ def _issue_certificate(
     provider: str = CertProvider.letsencrypt.value,
     eab_kid: str | None = None,
     eab_hmac_key: str | None = None,
+    preferred_chain: str | None = None,
     out_dir: Path,
     export_path: Path | None = None,
     verbose: bool = False,
@@ -2085,6 +2110,8 @@ def _issue_certificate(
 
     provider_name = provider
     client_kwargs: dict[str, Any] = {"contact_email": email}
+    if preferred_chain:
+        client_kwargs["preferred_chain"] = preferred_chain
     if staging:
         if provider != CertProvider.letsencrypt.value:
             raise CliError("--staging only applies to the letsencrypt provider")
@@ -2172,6 +2199,7 @@ def cert_issue(
     provider: ProviderOption = CertProvider.letsencrypt,
     eab_kid: EabKidOption = None,
     eab_hmac_key: EabHmacKeyOption = None,
+    preferred_chain: PreferredChainOption = None,
     force: Annotated[
         bool,
         typer.Option(
@@ -2218,6 +2246,7 @@ def cert_issue(
         provider=provider.value,
         eab_kid=eab_kid,
         eab_hmac_key=eab_hmac_key,
+        preferred_chain=preferred_chain.value if preferred_chain else None,
         staging=staging,
         out_dir=out_dir,
         export_path=out,
@@ -2268,6 +2297,7 @@ def cert_renew(
     provider: ProviderOption = CertProvider.letsencrypt,
     eab_kid: EabKidOption = None,
     eab_hmac_key: EabHmacKeyOption = None,
+    preferred_chain: PreferredChainOption = None,
     verbose: Annotated[
         bool,
         typer.Option("--verbose", "-v", help="Show detailed ACME progress."),
@@ -2302,6 +2332,7 @@ def cert_renew(
             provider=provider.value,
             eab_kid=eab_kid,
             eab_hmac_key=eab_hmac_key,
+            preferred_chain=preferred_chain.value if preferred_chain else None,
             out_dir=out_dir,
             verbose=verbose,
         )

{devnomads_cli-0.7.0 → devnomads_cli-0.8.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devnomads-cli"
-version = "0.7.0"
+version = "0.8.0"
 description = "Manage your DevNomads services from the command line"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -11,7 +11,7 @@ dependencies = [
     "httpx>=0.27",
     "rich>=13",
     "cryptography>=42",
-    "devnomads[acme]>=0.2.5",
+    "devnomads[acme]>=0.5.0",
 ]
 
 [project.scripts]