This repository implements 'lego', a production-grade ACME client written in Go for automating SSL/TLS certificate issuance and renewal with Let's Encrypt and other ACME-compliant Certificate Authorities. The system operates as both a CLI tool and a reusable library, supporting the full ACME protocol (RFC 8555) including account registration, order creation, challenge solving (HTTP-01, DNS-01, TLS-ALPN-01, and experimental DNS-PERSIST-01), certificate download, and lifecycle management (renewal, revocation, archival). Architecturally, the codebase is modular: a core ACME API client (`acme/api/`) handles protocol interactions; challenge solvers (`challenge/`) implement domain validation strategies; a plugin-style DNS provider system (`providers/dns/`) integrates with over 200 DNS service APIs for automated DNS-01 challenge resolution; a CLI layer (`cmd/`) provides subcommands for run, certificates, accounts, archives, and migration; and storage (`cmd/internal/storage/`) persists certificates, keys, and account data to disk. Configuration is via YAML files, environment variables, and dotenv files. Key entry points include `main.go` (application start), `cmd/cmd_root.go` (CLI root command), and `lego/client.go` (library entry point). The primary data flow involves the user specifying domains and challenge type, the client interacting with the ACME CA to create orders and solve challenges (e.g., creating a DNS TXT record via a provider API), and finally downloading and storing the issued certificate. External dependencies include the ACME CA servers, the DNS provider APIs, and optionally an HTTP server for HTTP-01 challenges. The codebase demonstrates strong engineering practices with extensive unit and end-to-end testing, a consistent provider interface, and several well-designed internal utilities (HTTP mock server, retry/polling, error wrappers). However, the large number of DNS providers introduces boilerplate duplication and potential API drift, and the project uses a custom Go-like language dialect that may pose tooling and onboarding risks.
acme.sh is a pure shell (POSIX sh) ACME protocol client for automated TLS/SSL certificate lifecycle management. It supports multiple Certificate Authorities (Let's Encrypt, ZeroSSL, Google, SSL.com, Actalis) and provides a wide range of validation methods including HTTP-01 (webroot, standalone, Apache, Nginx), DNS-01 (via 150+ DNS provider APIs), and TLS-ALPN-01. The tool is designed for unattended cron-based renewal and includes deploy hooks for installing certificates into various services (web servers, routers, firewalls, etc.) and notification hooks for alerting on renewal outcomes. The architecture is a monolithic shell script (acme.sh) that sources plugin modules from dnsapi/, deploy/, and notify/ directories. Each plugin follows a consistent function naming convention (e.g., dns_<provider>_add/rm, <target>_deploy, <service>_send) and uses shared internal helpers for HTTP requests, credential persistence, and JSON/XML parsing. The project emphasizes cross-platform compatibility (Linux, macOS, BSDs, Solaris, Windows/Cygwin) and avoids external dependencies beyond curl/wget and openssl. Key features include ECDSA and RSA key support, wildcard certificates, OCSP Must-Staple, External Account Binding (EAB), ACME Renewal Information (ARI, RFC 9773), and automatic upgrade. The codebase is well-tested across 20+ operating systems via GitHub Actions CI, using both Pebble test servers and real CAs. While the monolithic core script is large (~4000 lines), the plugin architecture enables easy extension for new DNS providers, deployment targets, and notification channels.
Nginx Proxy Manager is a full-stack web application that provides a graphical user interface and REST API for managing Nginx reverse proxy configurations, SSL/TLS certificates (via Let's Encrypt or custom uploads), TCP/UDP streams, access control lists, and user permissions. The system is designed to run as a Docker container and is primarily used by self-hosting enthusiasts and small-to-medium deployments to simplify the otherwise complex task of configuring Nginx and maintaining certificates. The architecture is a classic three-tier web application: a Node.js/Express backend (ES modules) with Objection.js/Knex ORM supporting SQLite, MySQL, and PostgreSQL; a React 18/19 frontend built with TypeScript, Vite, TanStack Query, and Tabler UI; and a set of s6-overlay managed services (backend, frontend, Nginx) inside a single Docker image. The backend generates Nginx configuration files from Liquid templates and reloads Nginx on any change. External dependencies include Nginx, Certbot (for Let's Encrypt), OpenSSL, and optionally a database server. Key entry points are `backend/index.js` (server startup, migration, setup, Express app) and `frontend/src/main.tsx` (React bootstrap). The primary data flow is: user creates or modifies a proxy host, redirection, stream, or certificate via the UI → API call → backend validates permissions and data → persists to database → regenerates relevant Nginx config files → tests configuration → reloads Nginx. The system also periodically checks for certificate expiration and renews via Certbot, and fetches IP ranges from Cloudflare/Cloudfront for access control. The codebase demonstrates solid engineering practices: a consistent internal service layer with access control and audit logging, a well-typed API client with automatic camelCase/decamelize conversion, a reusable table framework built on TanStack Table, and a comprehensive i18n system supporting 24+ locales. While some modules (e.g., certificate management) are large and could benefit from refactoring, the overall structure is clean and maintainable.
HTTPS-PORTAL is a Docker image that automates HTTPS setup using Nginx and Let's Encrypt. It provides a fully automated reverse proxy that obtains SSL certificates, configures Nginx, and handles renewal. The container runs multiple supervised processes via s6-overlay: Nginx, docker-gen (for automatic container discovery), cron (for certificate renewal), and a dynamic environment watcher. Configuration is driven by environment variables, primarily the `DOMAINS` variable which supports a rich syntax for specifying upstreams, redirects, basic auth, access restrictions, custom ports, and per-domain stages. The codebase is primarily Ruby scripts that parse domain descriptors, generate Nginx configuration from ERB templates, and orchestrate certificate signing via acme-tiny. The architecture is clean and modular, with clear separation between domain parsing, certificate management, and Nginx configuration generation. The repository includes comprehensive integration tests using Docker Compose and RSpec.