List every nginx server block currently in sites-enabled, with domain, upstream, and whether SSL looks configured. Read-only - parses config files directly, does not shell out to nginx. Use get_site_config for one domain's full raw config.

Get the raw, unparsed nginx config file for one domain from sites-available. Throws if no config exists for that domain - call list_sites first if you're not sure it exists.

List every certbot-managed certificate on the box with its expiry date and days remaining, via certbot certificates. Read-only. Covers all certs certbot knows about, not just domains with an active nginx site.

Resolve a domain (CNAME first, then A/AAAA) against public resolvers (1.1.1.1, 8.8.8.8) rather than this box's own DNS, so the result matches what Let's Encrypt and the public internet see. Use before issue_cert / create_site to confirm a domain actually points where you expect. For confirming something is listening behind nginx, use check_upstream_health instead.

TCP-probe an upstream host:port to confirm something is actually listening there, independent of nginx or DNS. Use to sanity-check an upstream before create_site, or to debug a 502 afterward. For confirming a public domain resolves, use check_dns instead.

Report whether the nginx service is active (via systemctl) and its version string. Read-only.

Tail nginx's access or error log (capped at 1000 lines). domain is a best-effort substring filter, not a true per-vhost filter - see the result's note.

List archived nginx configs created by delete_site, newest first. Feed a filename from here into restore_site's archive_filename to restore a specific archive instead of the newest.

List the automatic backups of site configs, newest first. A backup is taken of the existing config just before create_site, update_site, restore_site or rollback_site changes it (the newest 10 per domain are kept). Feed a filename from here into rollback_site's backup_filename to return to a specific version instead of the newest. Not the same as list_archived_sites, which holds configs removed by delete_site.

One-call health report for a domain: whether its nginx config exists and is enabled, whether nginx is running and passes nginx -t, whether the domain resolves, whether the upstream accepts TCP connections, whether a certificate covers it (and how long is left), and recent nginx error-log lines mentioning the site or its upstream. Read-only. Returns per-check status (ok/warn/fail/skipped), an overall healthy flag, and next_steps naming the tools that would fix each problem. Start here when a site is misbehaving instead of calling the individual check_* tools one by one.

Upsert a Route 53 CNAME record pointing domain at target. Safe to call repeatedly - it's an upsert, not create-only. Run this before create_site / issue_cert and allow a few minutes for DNS propagation; issue_cert re-checks resolution itself, so it's safe to retry issue_cert if it reports the domain isn't resolving yet. For an ACME DNS-01 TXT challenge record, use create_txt_record instead.

Delete the Route 53 CNAME record for a domain. Destructive - requires confirm:true to actually act; without it, returns what would happen and changes nothing. Looks up the exact existing record first rather than guessing its TTL/value.

Upsert a Route 53 TXT record - e.g. for an ACME DNS-01 challenge (_acme-challenge., as used by issue_wildcard_cert) or domain verification. Quotes the value automatically if the caller didn't. Clean up afterward with delete_txt_record. For a CNAME pointing a domain at an upstream, use create_domain_record instead.

Delete the Route 53 TXT record for a domain - e.g. to clean up an ACME DNS-01 challenge record left behind by create_txt_record or issue_wildcard_cert. Destructive - requires confirm:true to actually act; without it, returns what would happen and changes nothing. Looks up the exact existing record first rather than guessing its TTL/value. For a CNAME record, use delete_domain_record instead.

Create a new nginx server block from the websocket-capable default template. Validates and test-renders (nginx -t) before touching live config, and rolls back automatically if the test fails. Does NOT reload nginx or request a certificate - follow with reload_nginx to go live, then issue_cert to get SSL. To point an existing site at a different upstream later, use update_site instead of recreating it. If a config for the domain already exists it is replaced - after being backed up (see rollback_site).

Update an existing site's upstream by rewriting its proxy_pass directive(s) in place - everything else in the config, including any SSL server block issue_cert/certbot added, is left untouched. Fails if the domain has no existing config (use create_site instead) or has no proxy_pass directive to update. Test-renders before keeping the change and rolls back automatically if nginx -t fails. The previous config is backed up first, so a bad-but-valid change can be undone later with rollback_site. Does NOT reload nginx - call reload_nginx afterward.

Disable, archive, and delete the nginx server block for a domain. Destructive - requires confirm:true to actually act; without it, returns what would happen. Does not touch any certbot certificate for the domain. Does NOT reload nginx - call reload_nginx afterward. The archived copy can be brought back with restore_site.

Restore a domain's nginx config from its most recent archive (created by delete_site) and enable it. Destructive to any current config for that domain (which is backed up first, see rollback_site) - requires confirm:true. Test-renders before enabling and rolls back automatically if that fails. Does NOT reload nginx - call reload_nginx afterward.

Undo a config change: replace a site's current nginx config with a backup taken by create_site, update_site, restore_site or a previous rollback_site (see list_site_backups). Defaults to the newest backup, i.e. the config as it was before the last change. The current config is backed up first, so calling this again flips back. Requires confirm:true. Test-renders before keeping the result and leaves the current config in place if nginx -t fails. Does NOT reload nginx - call reload_nginx afterward.

Delete archived site configs (from delete_site) older than a threshold. Destructive - requires confirm:true to actually act; without it, lists what would be deleted and changes nothing. Continues past individual failures and reports how many actually got removed.

Run nginx -t and reload the live service only if the config test passes - never reloads a broken config. Call this after create_site, delete_site, or restore_site to apply the change; those tools do not reload automatically.

Request a certificate via certbot --nginx (HTTP-01 validation). Requires an nginx server block for domain to already exist (create_site) - certbot's nginx plugin edits that existing sites-available config in place, adding an SSL server block and an HTTP->HTTPS redirect; it does not create a new site from scratch, and it reloads nginx itself on success (no separate reload_nginx call needed). Pre-checks that the domain resolves and fails fast with guidance if not, avoiding a wasted attempt against Let's Encrypt's rate limits. Defaults to Let's Encrypt staging, which issues browser-untrusted certs but is exempt from rate limits - pass staging:false only when you're ready for a real, publicly CT-logged certificate: production Let's Encrypt enforces real per-domain issuance rate limits (a handful of certs per week), and a mis-issued cert isn't silently undone - call revoke_cert if you need to invalidate one. A local guard also refuses production requests that would exceed Let's Encrypt's duplicate-certificate, failed-validation or per-domain limits, reporting when to retry. For a *.domain wildcard, use issue_wildcard_cert instead - HTTP-01 can't validate wildcards.

Request a wildcard certificate (domain and *.domain) via certbot --dns-route53 (DNS-01 validation, required since HTTP-01 can't prove ownership of a wildcard). Requires the certbot-dns-route53 plugin installed on the box and AWS credentials in the environment (see README) - fails fast with guidance if credentials are missing. Defaults to staging; a local guard refuses production requests that would exceed Let's Encrypt's rate limits, reporting when to retry. For a single non-wildcard domain, use issue_cert instead.

Run certbot renew, optionally scoped to one cert via --cert-name. Defaults to --dry-run (simulates against Let's Encrypt staging without touching the live cert or rate limit) - pass dry_run:false only when you mean to actually renew. Always disables certbot's random pre-renewal sleep so the call returns synchronously.

Revoke a certificate with Let's Encrypt (e.g. after a key compromise) - the CA distrusts it immediately, browser-wide, for any site still serving it. Destructive and effectively irreversible - requires confirm:true. Leaves the cert files on disk; follow with delete_cert to remove them.

Delete a certificate's files from certbot's local store. Destructive - requires confirm:true. Does not revoke the certificate first - if it may be compromised, call revoke_cert before this. Any nginx config still referencing the deleted files will fail to reload afterward.