// Package certbot issues Let's Encrypt certificates via HTTP-01 webroot
// validation. Deliberately not the --nginx installer plugin - Skiff, not
// certbot, owns and regenerates skiff.d/*.conf.
package certbot

import (
	"context"
	"io"

	"skiff/internal/sh"
)

// Sync issues or expands the certificate named certName to cover exactly
// domains, via challenge files served from webroot. Idempotent. Assumes
// `certbot register` has already been run once on the host.
func Sync(ctx context.Context, out io.Writer, webroot, certName string, domains []string) error {
	args := []string{
		"certonly", "--webroot", "-w", webroot,
		"--cert-name", certName, "--expand",
		"--non-interactive", "--agree-tos", "--keep-until-expiring",
	}
	for _, d := range domains {
		args = append(args, "-d", d)
	}
	return sh.Run(ctx, out, "", "certbot", args...)
}