Major refactoring, updated config structure

2026-02-28 00:59:11 +01:00
parent 2e52eae151
commit 2cbab1a0a2
18 changed files with 876 additions and 753 deletions
--- a/internal/acme_manager.go
+++ b/internal/acme_manager.go
@@ -0,0 +1,636 @@
+package internal
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-acme/lego/v4/certcrypto"
+	"github.com/go-acme/lego/v4/certificate"
+	"github.com/go-acme/lego/v4/lego"
+	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
+	"github.com/go-acme/lego/v4/registration"
+)
+
+// ---------------------------------------------
+// Thread safety for your domain config map
+// (assumes you already have these globals elsewhere)
+// ---------------------------------------------
+// var MU sync.RWMutex
+// var domainConfigs map[string]*ezconf.Configuration
+// var config *ezconf.Configuration
+//
+// func getDomainConfig(domain string) (*ezconf.Configuration, bool) { ... }
+
+// ---------------------------------------------
+// ACME account User (file-backed)
+// ---------------------------------------------
+
+type fileUser struct {
+	Email        string                 `json:"email"`
+	Registration *registration.Resource `json:"registration,omitempty"`
+
+	privateKey crypto.PrivateKey `json:"-"`
+}
+
+func (u *fileUser) GetEmail() string                        { return u.Email }
+func (u *fileUser) GetRegistration() *registration.Resource { return u.Registration }
+func (u *fileUser) GetPrivateKey() crypto.PrivateKey        { return u.privateKey }
+
+// ---------------------------------------------
+// Manager config + manager
+// ---------------------------------------------
+
+type ACMEManager struct {
+	MU     sync.Mutex // serializes lego Client ops + account writes
+	Client *lego.Client
+	User   *fileUser
+
+	// root dirs
+	dataRoot    string // e.g. /var/local/certman
+	accountRoot string // e.g. /var/local/certman/accounts
+	CertsRoot   string // e.g. /var/local/certman/certificates
+}
+
+// DomainRuntimeConfig has domain-specific runtime settings derived from main+domain config.
+type DomainRuntimeConfig struct {
+	DomainName    string
+	Email         string
+	DataRoot      string
+	CADirURL      string
+	ExpiryDays    int
+	RenewPeriod   int
+	RequestMethod string
+	Subdomains    []string
+}
+
+type StoredCertMeta struct {
+	DomainKey     string    `json:"domain_key"`
+	Domains       []string  `json:"domains"`
+	CertURL       string    `json:"cert_url,omitempty"`
+	CertStableURL string    `json:"cert_stable_url,omitempty"`
+	LastIssued    time.Time `json:"last_issued,omitempty"`
+	LastRenewed   time.Time `json:"last_renewed,omitempty"`
+}
+
+// ---------------------------------------------
+// Public API
+// ---------------------------------------------
+
+// NewACMEManager initializes a long-lived lego Client using:
+// - file-backed account
+// - persistent ECDSA P-256 account key
+// - Let’s Encrypt production by default (from config fallback)
+// - Cloudflare DNS-01 only
+func NewACMEManager() (*ACMEManager, error) {
+	// Pull effective (main-only) certificate settings.
+	email := config.GetString("Certificates.email")
+	dataRoot := config.GetString("Certificates.data_root")
+	caDirURL := config.GetString("Certificates.ca_dir_url")
+
+	// Build manager paths
+	mgr := &ACMEManager{
+		dataRoot:    dataRoot,
+		accountRoot: filepath.Join(dataRoot, "accounts"),
+		CertsRoot:   filepath.Join(dataRoot, "certificates"),
+	}
+
+	if err := os.MkdirAll(mgr.accountRoot, 0o700); err != nil {
+		return nil, fmt.Errorf("create account root: %w", err)
+	}
+	if err := os.MkdirAll(mgr.CertsRoot, 0o700); err != nil {
+		return nil, fmt.Errorf("create certs root: %w", err)
+	}
+
+	// Create/load file-backed account User
+	user, err := loadOrCreateACMEUser(mgr.accountRoot, email)
+	if err != nil {
+		return nil, fmt.Errorf("load/create acme User: %w", err)
+	}
+
+	// Cloudflare provider (DNS-01 only).
+	// lego Cloudflare provider expects env vars (CLOUDFLARE_EMAIL/CLOUDFLARE_API_KEY or tokens). :contentReference[oaicite:2]{index=2}
+	restoreEnv, err := setCloudflareEnvFromMainConfig()
+	if err != nil {
+		return nil, err
+	}
+	defer restoreEnv()
+
+	legoCfg := lego.NewConfig(user)
+	legoCfg.CADirURL = caDirURL
+	// Secure cert key type for issued certs (ECDSA P-256)
+	legoCfg.Certificate.KeyType = certcrypto.EC256
+
+	client, err := lego.NewClient(legoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("lego.NewClient: %w", err)
+	}
+
+	cfProvider, err := cloudflare.NewDNSProvider()
+	if err != nil {
+		return nil, fmt.Errorf("cloudflare dns provider: %w", err)
+	}
+
+	if err := client.Challenge.SetDNS01Provider(cfProvider); err != nil {
+		return nil, fmt.Errorf("set dns-01 provider: %w", err)
+	}
+
+	mgr.Client = client
+	mgr.User = user
+
+	// Register account only on first run
+	if mgr.User.Registration == nil {
+		reg, err := mgr.Client.Registration.Register(registration.RegisterOptions{
+			TermsOfServiceAgreed: true,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("acme registration: %w", err)
+		}
+		mgr.User.Registration = reg
+		if err := saveACMEUser(mgr.accountRoot, mgr.User); err != nil {
+			return nil, fmt.Errorf("save acme User registration: %w", err)
+		}
+	}
+
+	return mgr, nil
+}
+
+// ObtainForDomain obtains a new cert for a configured domain and saves it to disk.
+func (m *ACMEManager) ObtainForDomain(domainKey string) (*certificate.Resource, error) {
+	rcfg, err := buildDomainRuntimeConfig(domainKey)
+	if err != nil {
+		return nil, err
+	}
+
+	domains := buildDomainList(rcfg.DomainName, rcfg.Subdomains)
+	if len(domains) == 0 {
+		return nil, fmt.Errorf("no domains built for %q", domainKey)
+	}
+
+	req := certificate.ObtainRequest{
+		Domains: domains,
+		Bundle:  true,
+	}
+
+	m.MU.Lock()
+	defer m.MU.Unlock()
+
+	res, err := m.Client.Certificate.Obtain(req)
+	if err != nil {
+		return nil, fmt.Errorf("obtain %q: %w", domainKey, err)
+	}
+
+	if err := m.saveCertFiles(domainKey, res, true); err != nil {
+		return nil, fmt.Errorf("save cert files for %q: %w", domainKey, err)
+	}
+
+	return res, nil
+}
+
+// RenewForDomain renews an existing stored cert for a domain key.
+func (m *ACMEManager) RenewForDomain(domainKey string) (*certificate.Resource, error) {
+	m.MU.Lock()
+	defer m.MU.Unlock()
+
+	existing, err := m.loadStoredResource(domainKey)
+	if err != nil {
+		return nil, fmt.Errorf("load stored resource for %q: %w", domainKey, err)
+	}
+
+	// RenewWithOptions is preferred in newer lego versions.
+	renewed, err := m.Client.Certificate.RenewWithOptions(*existing, &certificate.RenewOptions{
+		Bundle: true,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("renew %q: %w", domainKey, err)
+	}
+
+	if err := m.saveCertFiles(domainKey, renewed, false); err != nil {
+		return nil, fmt.Errorf("save renewed cert files for %q: %w", domainKey, err)
+	}
+
+	return renewed, nil
+}
+
+// GetCertPaths returns disk paths for the domain's cert material.
+func (m *ACMEManager) GetCertPaths(domainKey string) (certPEM, keyPEM string) {
+	base := SanitizeDomainKey(domainKey)
+	dir := filepath.Join(m.CertsRoot, base)
+	return filepath.Join(dir, base+".crt"),
+		filepath.Join(dir, base+".key")
+}
+
+// ---------------------------------------------
+// Domain runtime config assembly
+// ---------------------------------------------
+
+func buildDomainRuntimeConfig(domainKey string) (*DomainRuntimeConfig, error) {
+	domainCfg, exists := domainStore.Get(domainKey)
+	if !exists {
+		return nil, fmt.Errorf("domain config not found for %q", domainKey)
+	}
+
+	domainName := domainCfg.GetString("Domain.domain_name")
+
+	email := config.GetString("Certificates.email")
+
+	// domain override data_root can be blank -> main fallback
+	dataRoot, err := EffectiveString(domainCfg, "Certificates.data_root")
+	if err != nil {
+		return nil, err
+	}
+
+	caDirURL := config.GetString("Certificates.ca_dir_url")
+
+	expiry := domainCfg.GetInt("Certificates.expiry")
+
+	renewPeriod := domainCfg.GetInt("Certificates.renew_period")
+
+	requestMethod := domainCfg.GetString("Certificates.request_method")
+
+	subdomains := domainCfg.GetString("Certificates.subdomains")
+	subdomainArray := parseCSVLines(subdomains)
+
+	return &DomainRuntimeConfig{
+		DomainName:    domainName,
+		Email:         email,
+		DataRoot:      dataRoot,
+		CADirURL:      caDirURL,
+		ExpiryDays:    expiry,
+		RenewPeriod:   renewPeriod,
+		RequestMethod: requestMethod,
+		Subdomains:    subdomainArray,
+	}, nil
+}
+
+func parseCSVLines(raw string) []string {
+	// supports comma-separated and newline-separated lists
+	fields := strings.FieldsFunc(raw, func(r rune) bool {
+		return r == ',' || r == '\n' || r == '\r'
+	})
+	out := make([]string, 0, len(fields))
+	for _, f := range fields {
+		s := strings.TrimSpace(f)
+		if s != "" {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// If subdomains contains ["www","api"], returns ["example.com","www.example.com","api.example.com"].
+// If a subdomain entry looks like a full FQDN already, it is used as-is.
+func buildDomainList(baseDomain string, subs []string) []string {
+	seen := map[string]struct{}{}
+	add := func(d string) {
+		d = strings.TrimSpace(strings.ToLower(d))
+		if d == "" {
+			return
+		}
+		if _, ok := seen[d]; ok {
+			return
+		}
+		seen[d] = struct{}{}
+	}
+
+	add(baseDomain)
+
+	for _, s := range subs {
+		s = strings.TrimSpace(s)
+		if s == "" {
+			continue
+		}
+
+		if s == "*" {
+			add("*." + baseDomain)
+			continue
+		}
+
+		if strings.HasPrefix(s, "*.") && !strings.HasSuffix(s, "."+baseDomain) {
+			rest := strings.TrimPrefix(s, "*.")
+			if rest != "" {
+				add("*." + rest + "." + baseDomain)
+				continue
+			}
+		}
+
+		if strings.Contains(s, ".") {
+			add(s)
+			continue
+		}
+
+		add(s + "." + baseDomain)
+	}
+
+	out := make([]string, 0, len(seen))
+	for d := range seen {
+		out = append(out, d)
+	}
+	return out
+}
+
+// ---------------------------------------------
+// Cloudflare env setup from main config
+// ---------------------------------------------
+
+func setCloudflareEnvFromMainConfig() (restore func(), err error) {
+	// Your current defaults show legacy email + API key fields.
+	// Prefer API tokens in the future if you add them. Cloudflare provider supports both styles. :contentReference[oaicite:3]{index=3}
+	cfEmail := config.GetString("Cloudflare.cf_email")
+	cfAPIKey := config.GetString("Cloudflare.cf_api_key")
+
+	// Save prior env values so we can restore them after provider creation.
+	prevEmail, hadEmail := os.LookupEnv("CLOUDFLARE_EMAIL")
+	prevKey, hadKey := os.LookupEnv("CLOUDFLARE_API_KEY")
+
+	if err := os.Setenv("CLOUDFLARE_EMAIL", cfEmail); err != nil {
+		return nil, err
+	}
+	if err := os.Setenv("CLOUDFLARE_API_KEY", cfAPIKey); err != nil {
+		return nil, err
+	}
+
+	restore = func() {
+		if hadEmail {
+			_ = os.Setenv("CLOUDFLARE_EMAIL", prevEmail)
+		} else {
+			_ = os.Unsetenv("CLOUDFLARE_EMAIL")
+		}
+		if hadKey {
+			_ = os.Setenv("CLOUDFLARE_API_KEY", prevKey)
+		} else {
+			_ = os.Unsetenv("CLOUDFLARE_API_KEY")
+		}
+	}
+	return restore, nil
+}
+
+// ---------------------------------------------
+// File-backed ACME account persistence
+// ---------------------------------------------
+
+func loadOrCreateACMEUser(accountRoot, email string) (*fileUser, error) {
+	if err := os.MkdirAll(accountRoot, 0o700); err != nil {
+		return nil, err
+	}
+
+	accountJSON := filepath.Join(accountRoot, "account.json")
+	accountKey := filepath.Join(accountRoot, "account.key.pem")
+
+	jsonExists := fileExists(accountJSON)
+	keyExists := fileExists(accountKey)
+
+	switch {
+	case jsonExists && keyExists:
+		return loadACMEUser(accountRoot)
+	case !jsonExists && !keyExists:
+		return createACMEUser(accountRoot, email)
+	default:
+		return nil, fmt.Errorf("inconsistent account state (need both %s and %s)", accountJSON, accountKey)
+	}
+}
+
+func createACMEUser(accountRoot, email string) (*fileUser, error) {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("generate ECDSA P-256 account key: %w", err)
+	}
+
+	u := &fileUser{
+		Email:      email,
+		privateKey: priv,
+	}
+	if err := saveACMEUser(accountRoot, u); err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+func loadACMEUser(accountRoot string) (*fileUser, error) {
+	keyPEM, err := os.ReadFile(filepath.Join(accountRoot, "account.key.pem"))
+	if err != nil {
+		return nil, err
+	}
+	priv, err := parseECPrivateKeyPEM(keyPEM)
+	if err != nil {
+		return nil, err
+	}
+
+	raw, err := os.ReadFile(filepath.Join(accountRoot, "account.json"))
+	if err != nil {
+		return nil, err
+	}
+
+	var tmp struct {
+		Email        string                 `json:"email"`
+		Registration *registration.Resource `json:"registration,omitempty"`
+	}
+	if err := json.Unmarshal(raw, &tmp); err != nil {
+		return nil, err
+	}
+
+	return &fileUser{
+		Email:        tmp.Email,
+		Registration: tmp.Registration,
+		privateKey:   priv,
+	}, nil
+}
+
+func saveACMEUser(accountRoot string, u *fileUser) error {
+	if u == nil {
+		return errors.New("nil User")
+	}
+	if err := os.MkdirAll(accountRoot, 0o700); err != nil {
+		return err
+	}
+
+	keyPEM, err := marshalECPrivateKeyPEM(u.privateKey)
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(filepath.Join(accountRoot, "account.key.pem"), keyPEM, 0o600); err != nil {
+		return err
+	}
+
+	tmp := struct {
+		Email        string                 `json:"email"`
+		Registration *registration.Resource `json:"registration,omitempty"`
+	}{
+		Email:        u.Email,
+		Registration: u.Registration,
+	}
+	data, err := json.MarshalIndent(tmp, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(filepath.Join(accountRoot, "account.json"), data, 0o600); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func marshalECPrivateKeyPEM(pk crypto.PrivateKey) ([]byte, error) {
+	ec, ok := pk.(*ecdsa.PrivateKey)
+	if !ok {
+		return nil, fmt.Errorf("expected *ecdsa.PrivateKey, got %T", pk)
+	}
+	der, err := x509.MarshalECPrivateKey(ec)
+	if err != nil {
+		return nil, err
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: der}), nil
+}
+
+func parseECPrivateKeyPEM(data []byte) (*ecdsa.PrivateKey, error) {
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, errors.New("invalid PEM")
+	}
+	if block.Type != "EC PRIVATE KEY" {
+		return nil, fmt.Errorf("unexpected PEM type %q", block.Type)
+	}
+	return x509.ParseECPrivateKey(block.Bytes)
+}
+
+// ---------------------------------------------
+// Certificate storage / loading
+// ---------------------------------------------
+
+type storedResource struct {
+	Domain        string   `json:"domain"`
+	Domains       []string `json:"domains"`
+	CertURL       string   `json:"cert_url,omitempty"`
+	CertStableURL string   `json:"cert_stable_url,omitempty"`
+	Certificate   []byte   `json:"certificate,omitempty"`
+	PrivateKey    []byte   `json:"private_key,omitempty"`
+	IssuerCert    []byte   `json:"issuer_certificate,omitempty"`
+	CSR           []byte   `json:"csr,omitempty"`
+}
+
+func (m *ACMEManager) saveCertFiles(domainKey string, res *certificate.Resource, isNew bool) error {
+	if res == nil {
+		return errors.New("nil certificate resource")
+	}
+
+	base := SanitizeDomainKey(domainKey)
+	dir := filepath.Join(m.CertsRoot, base)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return err
+	}
+
+	if len(res.PrivateKey) > 0 {
+		if err := os.WriteFile(filepath.Join(dir, base+".key"), res.PrivateKey, 0o600); err != nil {
+			return err
+		}
+	}
+	if len(res.IssuerCertificate) > 0 {
+		fullchain := append(append([]byte{}, res.Certificate...), res.IssuerCertificate...)
+		if err := os.WriteFile(filepath.Join(dir, base+".crt"), fullchain, 0o600); err != nil {
+			return err
+		}
+	} else if len(res.Certificate) > 0 {
+		// fallback fullchain = cert only
+		if err := os.WriteFile(filepath.Join(dir, base+".pem"), res.Certificate, 0o600); err != nil {
+			return err
+		}
+	}
+
+	sr := storedResource{
+		Domain:        domainKey,
+		Domains:       append([]string(nil), res.Domain),
+		CertURL:       res.CertURL,
+		CertStableURL: res.CertStableURL,
+		Certificate:   res.Certificate,
+		PrivateKey:    res.PrivateKey,
+		IssuerCert:    res.IssuerCertificate,
+		CSR:           res.CSR,
+	}
+	js, err := json.MarshalIndent(sr, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(filepath.Join(dir, base+".json"), js, 0o600); err != nil {
+		return err
+	}
+
+	// metadata
+	meta := StoredCertMeta{
+		DomainKey:     domainKey,
+		Domains:       append([]string(nil), res.Domain),
+		CertURL:       res.CertURL,
+		CertStableURL: res.CertStableURL,
+	}
+	now := time.Now().UTC()
+	if old, err := m.loadMeta(domainKey); err == nil && !old.LastIssued.IsZero() {
+		meta.LastIssued = old.LastIssued
+	}
+	if isNew {
+		if meta.LastIssued.IsZero() {
+			meta.LastIssued = now
+		}
+	} else {
+		meta.LastRenewed = now
+		if meta.LastIssued.IsZero() {
+			meta.LastIssued = now
+		}
+	}
+	metaRaw, err := json.MarshalIndent(meta, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(filepath.Join(dir, base+".meta.json"), metaRaw, 0o600); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *ACMEManager) loadStoredResource(domainKey string) (*certificate.Resource, error) {
+	base := SanitizeDomainKey(domainKey)
+	dir := filepath.Join(m.CertsRoot, base)
+	raw, err := os.ReadFile(filepath.Join(dir, base+".json"))
+	if err != nil {
+		return nil, err
+	}
+
+	var sr storedResource
+	if err := json.Unmarshal(raw, &sr); err != nil {
+		return nil, err
+	}
+
+	return &certificate.Resource{
+		Domain:            sr.Domain,
+		CertURL:           sr.CertURL,
+		CertStableURL:     sr.CertStableURL,
+		Certificate:       sr.Certificate,
+		PrivateKey:        sr.PrivateKey,
+		IssuerCertificate: sr.IssuerCert,
+		CSR:               sr.CSR,
+	}, nil
+}
+
+func (m *ACMEManager) loadMeta(domainKey string) (*StoredCertMeta, error) {
+	base := SanitizeDomainKey(domainKey)
+	dir := filepath.Join(m.CertsRoot, base)
+	raw, err := os.ReadFile(filepath.Join(dir, base+".meta.json"))
+	if err != nil {
+		return nil, err
+	}
+	var meta StoredCertMeta
+	if err := json.Unmarshal(raw, &meta); err != nil {
+		return nil, err
+	}
+	return &meta, nil
+}
--- a/internal/buildinfo.go
+++ b/internal/buildinfo.go
@@ -0,0 +1,6 @@
+package internal
+
+var (
+	Version = "dev"
+	Build   = "local"
+)
--- a/internal/config.go
+++ b/internal/config.go
@@ -0,0 +1,400 @@
+package internal
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/google/uuid"
+	"github.com/spf13/viper"
+)
+
+var (
+	ErrBlankConfigEntry = errors.New("blank config entry")
+	ErrConfigNotFound   = errors.New("config file not found")
+)
+
+type DomainConfigStore struct {
+	mu      sync.RWMutex
+	configs map[string]*viper.Viper
+}
+
+func NewDomainConfigStore() *DomainConfigStore {
+	return &DomainConfigStore{
+		configs: make(map[string]*viper.Viper),
+	}
+}
+
+func (s *DomainConfigStore) Get(domain string) (*viper.Viper, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	v, ok := s.configs[domain]
+	return v, ok
+}
+
+func (s *DomainConfigStore) Set(domain string, v *viper.Viper) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.configs[domain] = v
+}
+
+// Swap atomically replaces the entire config map (used during reload).
+func (s *DomainConfigStore) Swap(newConfigs map[string]*viper.Viper) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.configs = newConfigs
+}
+
+// Snapshot returns a shallow copy safe to iterate without holding the lock.
+func (s *DomainConfigStore) Snapshot() map[string]*viper.Viper {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	snap := make(map[string]*viper.Viper, len(s.configs))
+	for k, v := range s.configs {
+		snap[k] = v
+	}
+	return snap
+}
+
+// ---------------------------------------------------------------------------
+//  Global state
+// ---------------------------------------------------------------------------
+
+var (
+	config      *viper.Viper
+	configMu    sync.RWMutex
+	domainStore = NewDomainConfigStore()
+)
+
+func Config() *viper.Viper {
+	configMu.RLock()
+	defer configMu.RUnlock()
+	return config
+}
+
+func DomainStore() *DomainConfigStore {
+	domainStore.mu.RLock()
+	defer domainStore.mu.RUnlock()
+	return domainStore
+}
+
+// ---------------------------------------------------------------------------
+//  Loading
+// ---------------------------------------------------------------------------
+
+// LoadConfig reads the main certman.conf into config.
+func LoadConfig() error {
+	config = viper.New()
+	config.SetConfigFile("/etc/certman/certman.conf")
+	config.SetConfigType("toml")
+	err := config.ReadInConfig()
+	if err != nil {
+		return err
+	}
+
+	switch config.GetString("App.mode") {
+	case "server":
+		config.SetConfigType("toml")
+		config.SetConfigFile("server.conf")
+		return config.MergeInConfig()
+	case "Client":
+		config.SetConfigType("toml")
+		config.SetConfigFile("Client.conf")
+		return config.MergeInConfig()
+	}
+
+	return nil
+}
+
+// LoadDomainConfigs reads every .conf file in the domains directory.
+func LoadDomainConfigs() error {
+	dir := "/etc/certman/domains/"
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return fmt.Errorf("reading domain config dir: %w", err)
+	}
+
+	temp := make(map[string]*viper.Viper)
+
+	for _, entry := range entries {
+		if entry.IsDir() || filepath.Ext(entry.Name()) != ".conf" {
+			continue
+		}
+
+		path := filepath.Join(dir, entry.Name())
+		v := viper.New()
+		v.SetConfigFile(path)
+		v.SetConfigType("toml")
+
+		if err := v.ReadInConfig(); err != nil {
+			return fmt.Errorf("loading %s: %w", path, err)
+		}
+
+		domain := v.GetString("domain.domain_name")
+		if domain == "" {
+			return fmt.Errorf("%s: missing domain.domain_name", path)
+		}
+
+		if _, exists := temp[domain]; exists {
+			fmt.Printf("Duplicate domain in %s, skipping...\n", path)
+			continue
+		}
+		temp[domain] = v
+	}
+
+	domainStore.Swap(temp)
+	return nil
+}
+
+// ---------------------------------------------------------------------------
+//  Saving
+// ---------------------------------------------------------------------------
+
+func WriteConfig(filePath string, config *viper.Viper) error {
+	var buf bytes.Buffer
+	if err := config.WriteConfigTo(&buf); err != nil {
+		return fmt.Errorf("marshal config: %w", err)
+	}
+
+	if err := os.WriteFile(filePath, buf.Bytes(), 0640); err != nil {
+		return fmt.Errorf("write config file: %w", err)
+	}
+	return nil
+}
+
+func WriteMainConfig() error {
+	return WriteConfig("/etc/certman/certman.conf", config)
+}
+
+func WriteDomainConfig(config *viper.Viper) error {
+	return WriteConfig(config.GetString("Domain.domain_name"), config)
+}
+
+// SaveDomainConfigs writes every loaded domain config back to disk.
+func SaveDomainConfigs() error {
+	for domain, v := range domainStore.Snapshot() {
+		err := WriteConfig("/etc/certman/domains/"+domain+".conf", v)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ---------------------------------------------------------------------------
+//  Effective lookups (domain → global fallback)
+// ---------------------------------------------------------------------------
+
+// EffectiveString looks up a key in the domain config first, falling back to
+// the global config. Keys use dot notation matching INI sections, e.g.
+// "certificates.data_root".
+func EffectiveString(domainCfg *viper.Viper, key string) (string, error) {
+	if domainCfg != nil {
+		val := strings.TrimSpace(domainCfg.GetString(key))
+		if val != "" {
+			return val, nil
+		}
+	}
+
+	if config == nil {
+		return "", ErrConfigNotFound
+	}
+
+	val := strings.TrimSpace(config.GetString(key))
+	if val == "" {
+		return "", ErrBlankConfigEntry
+	}
+	return val, nil
+}
+
+// MustEffectiveString is like EffectiveString but logs a fatal error on failure.
+func MustEffectiveString(domainCfg *viper.Viper, key string) string {
+	val, err := EffectiveString(domainCfg, key)
+	if err != nil {
+		log.Fatalf("Config key %q: %v", key, err)
+	}
+	return val
+}
+
+// EffectiveInt returns an int with domain → global fallback. Returns the
+// fallback value if the key is missing or zero in both configs.
+func EffectiveInt(domainCfg *viper.Viper, key string, fallback int) int {
+	if domainCfg != nil {
+		if val := domainCfg.GetInt(key); val != 0 {
+			return val
+		}
+	}
+	if config != nil {
+		if val := config.GetInt(key); val != 0 {
+			return val
+		}
+	}
+	return fallback
+}
+
+// EffectiveBool returns a bool with domain → global fallback.
+func EffectiveBool(domainCfg *viper.Viper, key string) bool {
+	if domainCfg != nil && domainCfg.IsSet(key) {
+		return domainCfg.GetBool(key)
+	}
+	if config != nil {
+		return config.GetBool(key)
+	}
+	return false
+}
+
+// ---------------------------------------------------------------------------
+//  Directory bootstrapping
+// ---------------------------------------------------------------------------
+
+func MakeDirs() {
+	dirs := []struct {
+		path string
+		perm os.FileMode
+	}{
+		{"/etc/certman", 0755},
+		{"/etc/certman/domains", 0755},
+		{"/var/local/certman", 0750},
+	}
+
+	for _, d := range dirs {
+		if err := os.MkdirAll(d.path, d.perm); err != nil {
+			log.Fatalf("Unable to create directory %s: %v", d.path, err)
+		}
+	}
+}
+
+func CreateConfig(mode string) {
+	content := strings.NewReplacer(
+		"{mode}", mode,
+	).Replace(defaultConfig)
+	createFile("/etc/certman/certman.conf", 0640, []byte(content))
+
+	switch mode {
+	case "server":
+		content = strings.NewReplacer(
+			"{uuid}", uuid.New().String(),
+		).Replace(defaultServerConfig)
+		createFile("/etc/certman/server.conf", 640, []byte(content))
+	}
+}
+
+func CreateDomainConfig(domain string) error {
+	key, err := GenerateKey()
+	if err != nil {
+		return fmt.Errorf("unable to generate key: %v", err)
+	}
+
+	var content string
+	switch Config().GetString("App.mode") {
+	case "server":
+		content = strings.NewReplacer(
+			"{domain}", domain,
+			"{key}", key,
+		).Replace(defaultServerDomainConfig)
+	case "Client":
+		content = strings.NewReplacer(
+			"{domain}", domain,
+			"{key}", key,
+		).Replace(defaultClientDomainConfig)
+	default:
+		return fmt.Errorf("unknown certman mode: %v", Config().GetString("App.mode"))
+	}
+
+	path := filepath.Join("/etc/certman/domains", domain+".conf")
+	createFile(path, 0640, []byte(content))
+	return nil
+}
+
+func CreateDomainCertsDir(domain string, dir string, dirOverride bool) {
+	var target string
+	if dirOverride {
+		target = filepath.Join(dir, domain)
+	} else {
+		target = filepath.Join("/var/local/certman/certificates", domain)
+	}
+
+	if err := os.MkdirAll(target, 0750); err != nil {
+		if os.IsExist(err) {
+			fmt.Println("Directory already exists...")
+			return
+		}
+		log.Fatalf("Error creating certificate directory for %s: %v", domain, err)
+	}
+}
+
+// ---------------------------------------------------------------------------
+//  Default config templates
+// ---------------------------------------------------------------------------
+
+const defaultConfig = `[App]
+mode = '{mode}'
+tick_rate = 2
+
+[Git]
+host = 'gitea'
+server = 'https://gitea.instance.com'
+username = 'User'
+api_token = 'xxxxxxxxxxxxxxxxxxxxxxxxx'
+org_name = 'org'
+
+[Certificates]
+data_root = '/var/local/certman'
+`
+
+const defaultServerConfig = `[App]
+uuid = '{uuid}'
+
+[Certificates]
+email = 'User@example.com'
+data_root = '/var/local/certman'
+ca_dir_url = 'https://acme-v02.api.letsencrypt.org/directory'
+
+[Cloudflare]
+cf_email = 'email@example.com'
+cf_api_key = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'`
+
+const defaultClientConfig = ``
+
+const defaultServerDomainConfig = `[Domain]
+domain_name = '{domain}'
+enabled = true
+dns_server = 'default'
+
+[Certificates]
+data_root = ''
+expiry = 90
+request_method = 'dns-01'
+renew_period = 30
+subdomains = []
+crypto_key = '{key}'
+
+[Repo]
+repo_suffix = '-certificates'
+
+[Internal]
+last_issued = 0
+repo_exists = false
+status = 'clean'
+`
+
+const defaultClientDomainConfig = `[Certificates]
+data_root = ''
+cert_symlinks = []
+key_symlinks = []
+crypto_key = '{key}'
+
+[Domain]
+domain_name = '{domain}'
+enabled = true
+
+[Repo]
+repo_suffix = '-certificates'
+`
+
+const readme = ``
--- a/internal/crypto.go
+++ b/internal/crypto.go
@@ -0,0 +1,131 @@
+package internal
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	"golang.org/x/crypto/chacha20poly1305"
+)
+
+// GenerateKey returns a base64-encoded 32-byte random key suitable to use as the
+// symmetric passphrase for age scrypt mode. Store this securely (never in Git).
+func GenerateKey() (string, error) {
+	k := make([]byte, 32)
+	if _, err := rand.Read(k); err != nil {
+		return "", err
+	}
+	out := make([]byte, base64.StdEncoding.EncodedLen(len(k)))
+	base64.StdEncoding.Encode(out, k)
+	return string(out), nil
+}
+
+func decodeKey(b64 string) ([]byte, error) {
+	key, err := base64.StdEncoding.DecodeString(b64) // standard padded
+	if err != nil {
+		return nil, err
+	}
+	if len(key) != chacha20poly1305.KeySize {
+		return nil, fmt.Errorf("bad key length: got %d, want %d", len(key), chacha20poly1305.KeySize)
+	}
+	return key, nil
+}
+
+func EncryptFileXChaCha(keyB64, inPath, outPath string, aad []byte) error {
+	key, err := decodeKey(keyB64)
+	if err != nil {
+		return err
+	}
+
+	aead, err := chacha20poly1305.NewX(key)
+	if err != nil {
+		return fmt.Errorf("new aead: %w", err)
+	}
+
+	plaintext, err := os.ReadFile(inPath)
+	if err != nil {
+		return fmt.Errorf("read input: %w", err)
+	}
+
+	nonce := make([]byte, chacha20poly1305.NonceSizeX) // 24 bytes
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return fmt.Errorf("nonce: %w", err)
+	}
+
+	ciphertext := aead.Seal(nil, nonce, plaintext, aad)
+
+	// Write: nonce || ciphertext
+	out := make([]byte, 0, len(nonce)+len(ciphertext))
+	out = append(out, nonce...)
+	out = append(out, ciphertext...)
+
+	if err := os.WriteFile(outPath, out, 0600); err != nil {
+		return fmt.Errorf("write output: %w", err)
+	}
+	return nil
+}
+
+func DecryptFileXChaCha(keyB64, inPath, outPath string, aad []byte) error {
+	key, err := decodeKey(keyB64)
+	if err != nil {
+		return err
+	}
+
+	aead, err := chacha20poly1305.NewX(key)
+	if err != nil {
+		return fmt.Errorf("new aead: %w", err)
+	}
+
+	in, err := os.ReadFile(inPath)
+	if err != nil {
+		return fmt.Errorf("read input: %w", err)
+	}
+	if len(in) < chacha20poly1305.NonceSizeX {
+		return errors.New("ciphertext too short")
+	}
+
+	nonce := in[:chacha20poly1305.NonceSizeX]
+	ciphertext := in[chacha20poly1305.NonceSizeX:]
+
+	plaintext, err := aead.Open(nil, nonce, ciphertext, aad)
+	if err != nil {
+		return fmt.Errorf("decrypt/auth failed: %w", err)
+	}
+
+	if err := os.WriteFile(outPath, plaintext, 0640); err != nil {
+		return fmt.Errorf("write output: %w", err)
+	}
+	return nil
+}
+
+func DecryptFileFromBytes(keyB64 string, inBytes []byte, outPath string, aad []byte) error {
+	key, err := decodeKey(keyB64)
+	if err != nil {
+		return err
+	}
+
+	aead, err := chacha20poly1305.NewX(key)
+	if err != nil {
+		return fmt.Errorf("new aead: %w", err)
+	}
+
+	if len(inBytes) < chacha20poly1305.NonceSizeX {
+		return errors.New("ciphertext too short")
+	}
+
+	nonce := inBytes[:chacha20poly1305.NonceSizeX]
+	ciphertext := inBytes[chacha20poly1305.NonceSizeX:]
+
+	plaintext, err := aead.Open(nil, nonce, ciphertext, aad)
+	if err != nil {
+		return fmt.Errorf("decrypt/auth failed: %w", err)
+	}
+
+	if err := os.WriteFile(outPath, plaintext, 0640); err != nil {
+		return fmt.Errorf("write output: %w", err)
+	}
+	return nil
+}
--- a/internal/git.go
+++ b/internal/git.go
@@ -0,0 +1,374 @@
+package internal
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"code.gitea.io/sdk/gitea"
+	"github.com/go-git/go-billy/v5"
+	"github.com/go-git/go-git/v5"
+	gitconf "github.com/go-git/go-git/v5/config"
+	"github.com/go-git/go-git/v5/plumbing/object"
+	"github.com/go-git/go-git/v5/plumbing/transport/http"
+	"github.com/go-git/go-git/v5/storage/memory"
+	"github.com/spf13/viper"
+)
+
+type CertManMode int
+
+const (
+	Server CertManMode = iota
+	Client
+)
+
+type GitWorkspace struct {
+	Repo     *git.Repository
+	Storage  *memory.Storage
+	FS       billy.Filesystem
+	WorkTree *git.Worktree
+}
+
+type GitSource int
+
+const (
+	Github GitSource = iota
+	Gitlab
+	Gitea
+	Gogs
+	Bitbucket
+	CodeCommit
+)
+
+var GitSourceName = map[GitSource]string{
+	Github:     "github",
+	Gitlab:     "gitlab",
+	Gitea:      "gitea",
+	Gogs:       "gogs",
+	Bitbucket:  "bitbucket",
+	CodeCommit: "code-commit",
+}
+
+func StrToGitSource(s string) (GitSource, error) {
+	for k, v := range GitSourceName {
+		if v == s {
+			return k, nil
+		}
+	}
+	return GitSource(0), errors.New("invalid gitsource name")
+}
+
+//func createGithubClient() *github.Client {
+//	return github.NewClient(nil).WithAuthToken(config.GetString("Git.api_token"))
+//}
+
+func CreateGiteaClient() *gitea.Client {
+	client, err := gitea.NewClient(config.GetString("Git.server"), gitea.SetToken(config.GetString("Git.api_token")))
+	if err != nil {
+		fmt.Printf("Error connecting to gitea instance: %v\n", err)
+		return nil
+	}
+	return client
+}
+
+//func createGithubRepo(domain *Domain, Client *github.Client) string {
+//	name := domain.name
+//	owner := domain.config.GetString("Repo.owner")
+//	description := domain.description
+//	private := true
+//	includeAllBranches := false
+//
+//	ctx := context.Background()
+//	template := &github.TemplateRepoRequest{
+//		Name:               name,
+//		Owner:              &owner,
+//		Description:        description,
+//		Private:            &private,
+//		IncludeAllBranches: &includeAllBranches,
+//	}
+//	repo, _, err := Client.Repositories.CreateFromTemplate(ctx, config.GetString("Git.org_name"), config.GetString("Git.template_name"), template)
+//	if err != nil {
+//		fmt.Println("Error creating repository from template,", err)
+//		return ""
+//	}
+//	return *repo.CloneURL
+//}
+
+func CreateGiteaRepo(domain string, giteaClient *gitea.Client) string {
+	domainConfig, exists := domainStore.Get(domain)
+	if !exists {
+		fmt.Printf("Domain %s config does not exist\n", domain)
+		return ""
+	}
+	options := gitea.CreateRepoOption{
+		Name:          domain + domainConfig.GetString("Repo.repo_suffix"),
+		Description:   "Certificate storage for " + domain,
+		Private:       true,
+		IssueLabels:   "",
+		AutoInit:      false,
+		Template:      false,
+		Gitignores:    "",
+		License:       "",
+		Readme:        "",
+		DefaultBranch: "master",
+		TrustModel:    gitea.TrustModelDefault,
+	}
+
+	giteaRepo, _, err := giteaClient.CreateOrgRepo(config.GetString("Git.org_name"), options)
+	if err != nil {
+		fmt.Printf("Error creating repo: %v\n", err)
+		return ""
+	}
+	return giteaRepo.CloneURL
+}
+
+func InitRepo(url string, ws *GitWorkspace) error {
+	var err error
+	ws.Repo, err = git.Init(ws.Storage, ws.FS)
+	if err != nil {
+		fmt.Printf("Error initializing local repo: %v\n", err)
+		return err
+	}
+
+	_, err = ws.Repo.CreateRemote(&gitconf.RemoteConfig{
+		Name: "origin",
+		URLs: []string{url},
+	})
+	if err != nil && !errors.Is(err, git.ErrRemoteExists) {
+		fmt.Printf("Error creating remote origin repo: %v\n", err)
+		return err
+	}
+
+	ws.WorkTree, err = ws.Repo.Worktree()
+	if err != nil {
+		fmt.Printf("Error getting worktree from local repo: %v\n", err)
+		return err
+	}
+
+	return nil
+}
+
+func CloneRepo(url string, ws *GitWorkspace, certmanMode CertManMode) error {
+	creds := &http.BasicAuth{
+		Username: config.GetString("Git.username"),
+		Password: config.GetString("Git.api_token"),
+	}
+	var err error
+	ws.Repo, err = git.Clone(ws.Storage, ws.FS, &git.CloneOptions{URL: url, Auth: creds})
+	if err != nil {
+		fmt.Printf("Error cloning repo: %v\n", err)
+	}
+
+	ws.WorkTree, err = ws.Repo.Worktree()
+	if err != nil {
+		fmt.Printf("Error getting worktree from cloned repo: %v\n", err)
+		return err
+	}
+	if certmanMode == Server {
+		serverIdFile, err := ws.FS.OpenFile("/SERVER_ID", os.O_RDWR, 0640)
+		if err != nil {
+			if os.IsNotExist(err) {
+				fmt.Printf("Server ID file not found for %s, adopting domain\n", url)
+				return nil
+			}
+			return err
+		}
+		serverIdBytes, err := io.ReadAll(serverIdFile)
+		if err != nil {
+			return err
+		}
+		serverId := strings.TrimSpace(string(serverIdBytes))
+		if serverId != config.GetString("App.uuid") {
+			return fmt.Errorf("domain is already managed by server with uuid %s", serverId)
+		}
+	}
+	return nil
+}
+
+func AddAndPushCerts(domain string, ws *GitWorkspace) error {
+	domainConfig, exists := domainStore.Get(domain)
+	if !exists {
+		fmt.Printf("Domain %s config does not exist\n", domain)
+		return ErrConfigNotFound
+	}
+
+	certsDir, err := DomainCertsDirWConf(domain, domainConfig)
+	if err != nil {
+		if errors.Is(err, ErrConfigNotFound) {
+			fmt.Printf("Domain %s config not found: %v\n", domain, err)
+			return err
+		}
+		fmt.Printf("Error getting domain %s certs dir: %v\n", domain, err)
+	}
+
+	certFiles, err := os.ReadDir(certsDir)
+	if err != nil {
+		fmt.Printf("Error reading from directory: %v\n", err)
+		return err
+	}
+	for _, entry := range certFiles {
+		if strings.HasSuffix(entry.Name(), ".crpt") {
+			file, err := ws.FS.Create(entry.Name())
+			if err != nil {
+				fmt.Printf("Error copying file to memfs: %v\n", err)
+				return err
+			}
+			certFile, err := os.ReadFile(filepath.Join(certsDir, entry.Name()))
+			if err != nil {
+				fmt.Printf("Error reading file to memfs: %v\n", err)
+				file.Close()
+				return err
+			}
+			_, err = file.Write(certFile)
+			if err != nil {
+				fmt.Printf("Error writing to memfs: %v\n", err)
+				file.Close()
+				return err
+			}
+			_, err = ws.WorkTree.Add(file.Name())
+			if err != nil {
+				fmt.Printf("Error adding file %v: %v\n", file.Name(), err)
+				file.Close()
+				return err
+			}
+			err = file.Close()
+			if err != nil {
+				fmt.Printf("Error closing file: %v\n", err)
+			}
+		}
+
+		file, err := ws.FS.Create("/SERVER_ID")
+		if err != nil {
+			fmt.Printf("Error creating file in memfs: %v\n", err)
+			return err
+		}
+		_, err = file.Write([]byte(config.GetString("App.uuid")))
+		if err != nil {
+			fmt.Printf("Error writing to memfs: %v\n", err)
+			file.Close()
+			return err
+		}
+		_, err = ws.WorkTree.Add(file.Name())
+		if err != nil {
+			fmt.Printf("Error adding file %v: %v\n", file.Name(), err)
+			file.Close()
+			return err
+		}
+		err = file.Close()
+		if err != nil {
+			fmt.Printf("Error closing file: %v\n", err)
+		}
+
+	}
+
+	status, err := ws.WorkTree.Status()
+	if err != nil {
+		fmt.Printf("Error getting repo status: %v\n", err)
+		return err
+	}
+	if status.IsClean() {
+		fmt.Printf("Repository is clean, skipping commit...\n")
+		return nil
+	}
+
+	fmt.Println("Work Tree Status:\n" + status.String())
+	signature := &object.Signature{
+		Name:  "Cert Manager",
+		Email: config.GetString("Certificates.email"),
+		When:  time.Now(),
+	}
+	_, err = ws.WorkTree.Commit("Update "+domain+" @ "+time.Now().Format("Mon Jan _2 2006 15:04:05 MST"), &git.CommitOptions{Author: signature, Committer: signature})
+	if err != nil {
+		fmt.Printf("Error committing certs: %v\n", err)
+		return err
+	}
+	creds := &http.BasicAuth{
+		Username: config.GetString("Git.username"),
+		Password: config.GetString("Git.api_token"),
+	}
+	err = ws.Repo.Push(&git.PushOptions{
+		Auth:       creds,
+		Force:      true,
+		RemoteName: "origin",
+		RefSpecs: []gitconf.RefSpec{
+			"refs/heads/master:refs/heads/master",
+		},
+	})
+	if err != nil {
+		fmt.Printf("Error pushing to origin: %v\n", err)
+		return err
+	}
+
+	fmt.Println("Successfully uploaded to " + config.GetString("Git.server") + "/" + config.GetString("Git.org_name") + "/" + domain + domainConfig.GetString("Repo.repo_suffix") + ".git")
+
+	return nil
+}
+
+func WriteCommitHash(hash string, domainConfig *viper.Viper) error {
+	certsDir, err := DomainCertsDirWOnlyConf(domainConfig)
+	if err != nil {
+		if errors.Is(err, ErrConfigNotFound) {
+			return err
+		}
+		return err
+	}
+
+	err = os.WriteFile(filepath.Join(certsDir, "hash"), []byte(hash), 0644)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func LocalCommitHash(domain string) (string, error) {
+	certsDir, err := DomainCertsDir(domain)
+	if err != nil {
+		if errors.Is(err, ErrConfigNotFound) {
+			fmt.Printf("Domain %s config not found: %v\n", domain, err)
+			return "", err
+		}
+		fmt.Printf("Error getting domain %s certs dir: %v\n", domain, err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(certsDir, "hash"))
+	if err != nil {
+		if !os.IsNotExist(err) {
+			fmt.Printf("Error reading file for domain %s: %v\n", domain, err)
+			return "", err
+		}
+	}
+
+	return strings.TrimSpace(string(data)), nil
+}
+
+func RemoteCommitHash(domain string, gitSource GitSource) (string, error) {
+	domainConfig, exists := DomainStore().Get(domain)
+	if !exists {
+		fmt.Printf("Domain %s config does not exist\n", domain)
+		return "", ErrConfigNotFound
+	}
+
+	switch gitSource {
+	case Gitea:
+		return getRemoteCommitHashGitea(config.GetString("Git.org_name"), domain+domainConfig.GetString("Repo.repo_suffix"), "master")
+	default:
+		fmt.Printf("Unimplemented git source %v\n", gitSource)
+		return "", errors.New("unimplemented git source")
+	}
+}
+
+func getRemoteCommitHashGitea(org, repo, branchName string) (string, error) {
+	giteaClient := CreateGiteaClient()
+	branch, _, err := giteaClient.GetRepoBranch(org, repo, branchName)
+	if err != nil {
+		fmt.Printf("Error getting repo branch: %v\n", err)
+		return "", err
+	}
+	//TODO catch repo not found as ErrRepoNotInit
+	return branch.Commit.ID, nil
+}
--- a/internal/util.go
+++ b/internal/util.go
@@ -0,0 +1,297 @@
+package internal
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"code.gitea.io/sdk/gitea"
+	"github.com/spf13/viper"
+)
+
+var (
+	ErrorPIDInUse = errors.New("daemon is already running")
+	ErrLockFailed = errors.New("failed to acquire a lock on the PID file")
+	ErrBlankCert  = errors.New("cert is blank")
+)
+
+type Domain struct {
+	name        *string
+	config      *viper.Viper
+	description *string
+	gtClient    *gitea.Client
+}
+
+// 0x01
+func createPIDFile() {
+	file, err := os.Create("/var/run/certman.pid")
+	if err != nil {
+		fmt.Printf("0x01: Error creating PID file: %v\n", err)
+		return
+	}
+	err = file.Close()
+	if err != nil {
+		fmt.Printf("0x01: Error closing PID file: %v\n", err)
+		return
+	}
+}
+
+// 0x02
+func ClearPIDFile() {
+	file, err := os.OpenFile("/var/run/certman.pid", os.O_RDWR|os.O_CREATE, 0644)
+	if err != nil {
+		fmt.Printf("0x02: Error opening PID file: %v\n", err)
+		return
+	}
+	defer file.Close()
+
+	err = file.Truncate(0)
+	if err != nil {
+		fmt.Printf("0x02: Error writing PID file: %v\n", err)
+		return
+	}
+}
+
+// 0x03
+func CreateOrUpdatePIDFile(filename string) error {
+	pidBytes, err := os.ReadFile(filename)
+	if err != nil {
+		fmt.Printf("0x03: Error reading PID file: %v\n", err)
+		return err
+	}
+
+	pidStr := strings.TrimSpace(string(pidBytes))
+	isPidFileEmpty := pidStr == ""
+
+	if !isPidFileEmpty {
+		pid, err := strconv.Atoi(pidStr)
+		if err != nil {
+			fmt.Printf("0x03: Error parsing PID file: %v\n", err)
+			return err
+		}
+
+		isProcActive, err := isProcessActive(pid)
+		if err != nil {
+			fmt.Printf("0x03: Error checking if process is active: %v\n", err)
+			return err
+
+		}
+		if isProcActive {
+			return ErrorPIDInUse
+		}
+	}
+
+	pidFile, err := os.OpenFile(filename, os.O_RDWR|os.O_CREATE, 0644)
+	if err != nil {
+		if os.IsNotExist(err) {
+			createPIDFile()
+		} else {
+			fmt.Printf("0x03: Error opening PID file: %v\n", err)
+			return err
+		}
+	}
+	defer pidFile.Close()
+
+	if err := syscall.Flock(int(pidFile.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+		if errors.Is(err, syscall.EWOULDBLOCK) {
+			return ErrLockFailed
+		}
+		return fmt.Errorf("error locking PID file: %w", err)
+	}
+	curPid := os.Getpid()
+	if _, err := pidFile.Write([]byte(strconv.Itoa(curPid))); err != nil {
+		return fmt.Errorf("error writing pid to PID file: %w", err)
+	}
+
+	return nil
+}
+
+// 0x04
+// isProcessActive checks whether the process with the provided PID is running.
+func isProcessActive(pid int) (bool, error) {
+	if pid <= 0 {
+		return false, errors.New("invalid process ID")
+	}
+	process, err := os.FindProcess(pid)
+	if err != nil {
+		// On Unix systems, os.FindProcess always succeeds and returns a process with the given pid, irrespective of whether the process exists.
+		return false, nil
+	}
+
+	err = process.Signal(syscall.Signal(0))
+	if err != nil {
+		if errors.Is(err, syscall.ESRCH) {
+			// The process does not exist
+			return false, nil
+		} else if errors.Is(err, os.ErrProcessDone) {
+			return false, nil
+		}
+		// Some other unexpected error
+		return false, err
+	}
+
+	// The process exists and is active
+	return true, nil
+}
+
+// 0x05
+func DaemonProcess() (*os.Process, error) {
+	pidBytes, err := os.ReadFile("/var/run/certman.pid")
+	if err != nil {
+		fmt.Printf("0x05: Error getting PID from /var/run/certman.pid: %v\n", err)
+		return nil, err
+	}
+	pidStr := strings.TrimSpace(string(pidBytes))
+	daemonPid, err := strconv.Atoi(pidStr)
+	if err != nil {
+		fmt.Printf("0x05: Error converting PID string to int (%s): %v\n", pidStr, err)
+		return nil, err
+	}
+	isProcActive, err := isProcessActive(daemonPid)
+	if err != nil {
+		fmt.Printf("0x05: Error checking if process is active: %v\n", err)
+	}
+	if !isProcActive {
+		return nil, errors.New("process is not active")
+	}
+	proc, err := os.FindProcess(daemonPid)
+	if err != nil {
+		fmt.Printf("0x05: Error finding process with PID %d: %v\n", daemonPid, err)
+		return nil, err
+	}
+	return proc, nil
+}
+
+func createFile(fileName string, filePermission os.FileMode, data []byte) {
+	fileInfo, err := os.Stat(fileName)
+	if err != nil {
+		if os.IsNotExist(err) {
+			file, err := os.Create(fileName)
+			if err != nil {
+				fmt.Println("Error creating configuration file: ", err)
+				os.Exit(1)
+			}
+
+			_, err = file.Write(data)
+			if err != nil {
+				fmt.Println("Error writing to file: ", err)
+				os.Exit(1)
+			}
+			err = file.Chmod(filePermission)
+			if err != nil {
+				fmt.Println("Error changing file permission: ", err)
+			}
+		} else {
+			fmt.Println("Error opening configuration file: ", err)
+			os.Exit(1)
+		}
+	} else {
+		if fileInfo.Size() == 0 {
+			file, err := os.Create(fileName)
+			if err != nil {
+				fmt.Println("Error creating configuration file: ", err)
+				os.Exit(1)
+			}
+
+			_, err = file.Write(data)
+			if err != nil {
+				fmt.Println("Error writing to file:", err)
+				os.Exit(1)
+			}
+		}
+	}
+}
+
+func LinkFile(source, target, domain, extension string) error {
+	if target == "" {
+		return ErrBlankCert
+	}
+	linkInfo, err := os.Stat(target)
+	if err != nil {
+		if os.IsNotExist(err) {
+			err = os.Symlink(source, target)
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+		return err
+	}
+	if linkInfo.IsDir() {
+		target = filepath.Join(target, domain+extension)
+	}
+
+	err = os.Symlink(source, target)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+func contains(slice []string, value string) (sliceHas bool, index int) {
+	for i, entry := range slice {
+		if entry == value {
+			return true, i
+		}
+	}
+	return false, -1
+}
+
+func insert(a []string, index int, value string) []string {
+	last := len(a) - 1
+	a = append(a, a[last])
+	copy(a[index+1:], a[index:last])
+	a[index] = value
+	return a
+}
+
+func SanitizeDomainKey(s string) string {
+	s = strings.TrimSpace(strings.ToLower(s))
+	r := strings.NewReplacer("/", "_", "\\", "_", " ", "_", ":", "_")
+	return r.Replace(s)
+}
+
+// DomainCertsDir Can return ErrBlankConfigEntry, ErrConfigNotFound, or other errors
+func DomainCertsDir(domain string) (string, error) {
+	domainConfig, exists := domainStore.Get(domain)
+	if !exists {
+		return "", ErrConfigNotFound
+	}
+
+	return DomainCertsDirWConf(domain, domainConfig)
+}
+
+// DomainCertsDirWConf Can return ErrBlankConfigEntry or other errors
+func DomainCertsDirWConf(domain string, domainConfig *viper.Viper) (string, error) {
+	effectiveDataRoot, err := EffectiveString(domainConfig, "Certificates.data_root")
+	if err != nil {
+		return "", err
+	}
+
+	return filepath.Join(effectiveDataRoot, "certificates", domain), nil
+}
+
+func DomainCertsDirWOnlyConf(domainConfig *viper.Viper) (string, error) {
+	domain := domainConfig.GetString("Domain.domain_name")
+	return DomainCertsDirWConf(domain, domainConfig)
+}
+
+func ChownRecursive(path string, uid, gid int) error {
+	return filepath.WalkDir(path, func(name string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err // Stop if we encounter a permission error on a specific file
+		}
+		// Apply ownership change to the current item
+		return os.Chown(name, uid, gid)
+	})
+}