mrambossekandClaude Fable 5
5d7f59a66a
HTTP-01 always arrives on port 80 - the CA chooses the port, not the operator - so it never collides with an admin UI on 443. The conflict only exists for TLS-ALPN-01, which is the challenge type that does use 443. Given that, the server keeps a permanent listener on 80 that answers challenges from a webroot and redirects everything else to the admin UI. Same arrangement as the webroot plugins for Apache and nginx, and better than letting the ACME client bind 80 per renewal: nothing binds and unbinds, so a renewal cannot fail because the port was briefly busy, and the client needs only write access to a directory instead of the privilege to bind a low port. Port 80 also gets a use it would want anyway. The ACME client stays an external program. lego is also a Go library, but importing it would put a large dependency tree into a server that deliberately has none, and the CLI does the same job from a timer. Tokens are validated by *shape* before any filesystem call, so traversal never reaches the disk - a stronger guarantee than sanitising a path and trusting the sanitiser. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>