README.md

@@ -1,47 +1,109 @@
-# [Greenlock Express v4](https://git.rootprojects.org/root/greenlock-express.js) is Let's Encrypt for Node
+# [Greenlock Express](https://git.rootprojects.org/root/greenlock-express.js) is Let's Encrypt for Node
-
-| Built by [Root](https://therootcompany.com) for [Hub](https://rootprojects.org/hub/) |
 
 ![Greenlock Logo](https://git.rootprojects.org/root/greenlock.js/raw/branch/master/logo/greenlock-1063x250.png "Greenlock Logo")
 
-### Free SSL for Node Web Servers
+| Built by [Root](https://therootcompany.com) for [Hub](https://rootprojects.org/hub/)
+
+Free SSL, Automated HTTPS / HTTP2, served with Node via Express, Koa, hapi, etc.
+
+### Let's Encrypt for Node and Express (and Koa, hapi, rill, etc)
 
 Greenlock Express is a **Web Server** with **Fully Automated HTTPS** and renewals.
 
-You define your app and let Greenlock handle issuing and renewing Free SSL Certificates.
+You define your app, and let Greenlock handle issuing and renewing Free SSL Certificates.
+
+**Cloud-ready** with Node `cluster`.
+
+# Serve your Sites with Free SSL
+
+-   1. Create a Project with Greenlock Express
+-   2. Initialize and Setup
+-   3. Add Domains, and Hello, World!
+
+### Create your project
 
 ```bash
 npm init
-npm install --save greenlock-express@v4
 ```
 
-`server.js`:
+```bash
+npm install --save greenlock-express@v3
+```
+
+```bash
+npx greenlock init --maintainer-email 'jon@example.com' --manager-config-file ./greenlock.json
+```
+
+<details>
+<summary>server.js</summary>
 
 ```js
 "use strict";
 
-var app = require("./app.js");
-
 require("greenlock-express")
-    .init({
+    .init(function() {
-        packageRoot: __dirname,
+        return {
-        configDir: "./greenlock.d",
+            greenlock: require("./greenlock.js"),
 
-        // contact for security and critical bug notices
+            // whether or not to run at cloudscale
-        maintainerEmail: "jon@example.com",
+            cluster: false
-
+        };
-        // whether or not to run at cloudscale
-        cluster: false
     })
-    // Serves on 80 and 443
+    .ready(function(glx) {
-    // Get's SSL certificates magically!
+        var app = require("./app.js");
-    .serve(app);
+
+        // Serves on 80 and 443
+        // Get's SSL certificates magically!
+        glx.serveApp(app);
+    });
 ```
 
-`./greenlock.d/config.json`:
+</details>
 
-```json
+<details>
-{ "sites": [{ "subject": "example.com", "altnames": ["example.com"] }] }
+<summary>greenlock.js</summary>
+
+```js
+"use strict";
+
+var pkg = require("./package.json");
+module.exports = require("@root/greenlock").create({
+    // name & version for ACME client user agent
+    packageAgent: pkg.name + "/" + pkg.version,
+
+    // contact for security and critical bug notices
+    maintainerEmail: pkg.author,
+
+    // where to find .greenlockrc and set default paths
+    packageRoot: __dirname
+});
+```
+
+</details>
+
+<details>
+<summary>app.js</summary>
+
+```js
+var app = function(req, res) {
+    res.end("Hello, Encrypted World!");
+};
+
+module.exports = app;
+```
+
+</details>
+
+```bash
+npx greenlock defaults --subscriber-email 'jon@example.com' --agree-to-terms
+```
+
+```bash
+npx greenlock add --subject example.com --altnames example.com
+```
+
+```bash
+npm start -- --staging
 ```
 
 # Let's Encrypt for...
@@ -66,353 +128,297 @@ require("greenlock-express")
     -   [x] **Wildcard** SSL
     -   [x] **Localhost** certificates
     -   [x] HTTPS-enabled Secure **WebSockets** (`wss://`)
-    -   [x] **Cloud-ready** with Node `cluster`.
 -   [x] Fully customizable
     -   [x] **Reasonable defaults**
     -   [x] Domain Management
     -   [x] Key and Certificate Management
     -   [x] ACME Challenge Plugins
 
-# Compatibility
+# QuickStart Guide
 
-Works with _any_ node http app, including
+Easy as 1, 2, 3... 4
 
--   [x] Express
+<details>
--   [x] Koa
+<summary>1. Create a node project</summary>
--   [x] hapi
--   [x] rill
--   [x] http2
--   [x] cluster
--   [x] etc...
 
-# v4 QuickStart
+## 1. Create a node project
 
-Serving sites with Free SSL is as easy as 1, 2, 3... 4
+Create an empty node project.
 
-## Overview
+Be sure to fill out the package name, version, and an author email.
-
-1. Create a Project with Greenlock Express
-    - `server.js`
-    - `app.js`
-2. Setup the config file (or database)
-    - `.greenlockrc`
-    - `greenlock.d/config.json`
-3. Add Domains
-    - `npx greenlock add --subject example.com --altnames example.com`
-4. Hello, World!
-    - `npm start -- --staging`
-
-### TL;DR
-
-If you're familiar with node, npm, and npx: this is all you need to do:
 
 ```bash
+mkdir ~/my-project
+pushd ~/my-project
 npm init
-npm install --save greenlock-express@v4
-
-npx greenlock init --config-dir greenlock.d --maintainer-email jon@example.com
-npx greenlock add --subject example.com --altnames example.com
-
-npm start -- --staging
 ```
 
-Once you've tested that that works, you can change `app.js` to suit your needs replace the built-in callbacks for things like certificate storage as you like.
+</details>
 
-## 1. Create your Project
+<details>
+<summary>2. Create an http app (i.e. express)</summary>
 
-If you need to install Node.js, do so:
+## 2. Create an http app (i.e. express)
 
-Mac, Linux:
+This example is shown with Express, but any node app will do. Greenlock
+works with everything.
+(or any node-style http app)
 
-```bash
+`my-express-app.js`:
-curl -fsS https://webinstall.dev/node | bash
-```
-
-Windows 10:
-
-```pwsh
-curl -fsSA "MS" https://webinstall.dev/node | powershell
-```
-
-Then create a directory for your project, and initialize it:
-
-```bash
-mkdir -p my-sites
-pushd my-sites
-npm init
-npm install --save greenlock-express@v4
-```
-
-## 2. Initialize and Config (Dir or DB)
-
-You can use **local file storage** or a **database**. The default is to use file storage.
-
-You'll need to create `server.js` and `greenlock.d/config.json`. You can do so using the CLI, API, or by hand.
-
-### Using the CLI (simplest, recommended)
-
-Anytime you install an npm module that contains an executable,
-you can run it using `npx`.
-
-To initialize the Greenlock config, run `npx greenlock init`:
-
-```bash
-npx greenlock init --config-dir ./greenlock.d --maintainer-email 'jon@example.com'
-```
-
-### By Hand (for advanced users)
-
-Create `server.js` like so:
-
-`server.js`:
 
 ```js
-'use strict';
+"use strict";
 
-var app = require('./app.js');
+// A plain, node-style app
 
-require('greenlock-express')
+function myPlainNodeHttpApp(req, res) {
-    .init({
+    res.end("Hello, Encrypted World!");
-        packageRoot: __dirname,
+}
 
-        // where to look for configuration
+// Wrap that plain app in express,
-        configDir: './greenlock.d',
+// because that's what you're used to
 
-        // whether or not to run at cloudscale
+var express = require("express");
-        cluster: false
+var app = express();
-    })
+app.get("/", myPlainNodeHttpApp);
-    // Serves on 80 and 443
-    // Get's SSL certificates magically!
-    .serve(app);
-```
 
-Create `app.js` like so:
+// export the app normally
-
+// do not .listen()
-`app.js`:
-
-```js
-'use strict';
-
-// Here's a vanilla HTTP app to start,
-// but feel free to replace it with Express, Koa, etc
-var app = function(req, res) {
-    res.end('Hello, Encrypted World!');
-};
 
 module.exports = app;
 ```
 
-Greenlock uses `.greenlockrc` to figure out whether to use the file system or a database for config,
+</details>
-as well as where its root directory is.
 
-`.greenlockrc`
+<details>
+<summary>3. Serve with Greenlock Express</summary>
 
-```json
+## 3. Serve with Greenlock Express
-{"manager":{"module":"@greenlock/manager"},"configDir":"greenlock.d"}
+
+Greenlock Express is designed with these goals in mind:
+
+-   Simplicity and ease-of-use
+-   Performance and scalability
+-   Configurability and control
+
+You can start with **near-zero configuration** and
+slowly add options for greater performance and customization
+later, if you need them.
+
+`server.js`:
+
+```js
+"use strict";
+
+require("greenlock-express")
+    .init(function() {
+        var pkg = require("./package.json");
+        return {
+            greenlock: require("@root/greenlock").create({
+                // name & version for ACME client user agent
+                packageAgent: pkg.name + "/" + pkg.version,
+
+                // contact for security and critical bug notices
+                maintainerEmail: pkg.author,
+
+                // where to find .greenlockrc and set default paths
+                packageRoot: __dirname
+            }),
+
+            // whether or not to run at cloudscale
+            cluster: false
+        };
+    })
+    .ready(function(glx) {
+        var app = require("./app.js");
+
+        // Serves on 80 and 443
+        // Get's SSL certificates magically!
+        glx.serveApp(app);
+    });
 ```
 
-The `greenlock.d/config.json` is NOT intended to be edited by hand, as it is a substitute for a database, but it looks like this:
+And start your server:
-
-```json
-{ "defaults": { "subscriberEmail": "john.doe@example.com" }, "sites": [] }
-```
-
-## 3. Add Sites
-
-For security, you must specify which sites you allow to request certificates. If you need this to be dynamic (i.e. checking a database or API, see the section below on custom site managers).
-
-Every site has a "subject" (its primary domain name) and one or more "altnames" (secondary or related domain names on the same certificate).
-
-### Using CLI (simple, recommended)
-
-Simply supply the names of sites that you manage and they will be added to the file system config, or database.
 
 ```bash
-npx greenlock add --subject example.com --altnames example.com,www.example.com
+# Allow non-root node to use ports 80 (HTTP) and 443 (HTTPS)
+sudo setcap 'cap_net_bind_service=+ep' $(which node)
 ```
 
-### By Hand (debugging only)
-
-You should NOT edit `greenlock.d/config.json` with your own tools. Use `greenlock.manager.add({})` instead.
-
-`greenlock.d/config.json`:
-
-<!-- TODO update manager to write array rather than object -->
-
-```json
-{ "sites": [{ "subject": "example.com", "altnames": [ "example.com", "www.example.com" ] }] }
-```
-
-## 4. Hello, Encrypted World!
-
-That was it! Now you can run your server!
-
-When you run `npm start`, it will automatically run `node server.js` (or `package.json.scripts.start`).
-
-For arguments that `npm start` should ignore, place them after `--`.
-
-Here we use `--staging` in order to tell greenlock to issue test certificates rather than real certificates.
-
 ```bash
-# Note: you can use npm start to run server.js with the --staging flag set
+# `npm start` will call `node ./server.js` by default
+npm start
+```
+
+```bash
+# use --staging to use the development API until you're ready to get real certificates
 npm start -- --staging
 ```
 
 ```txt
-> my-project@1.0.0 start /srv/www/my-project
+Greenlock v3.0.0
-> node server.js
+Greenlock Manager Config File: ~/.config/greenlock/manager.json
+Greenlock Storage Directory: ~/.config/greenlock/
 
 Listening on 0.0.0.0:80 for ACME challenges and HTTPS redirects
 Listening on 0.0.0.0:443 for secure traffic
 ```
 
-If everything worked you can visit your site in your browser, and after a few seconds you'll get a certificate warning and, after that, see a "Hello World" message. The debug (staging) certificates will be saved in `greenlock.d/staging`. Run again without `--staging` and you will get real certificates.
+</details>
 
-### Season to taste
+<details>
+<summary>4. Manage SSL Certificates and Domains</summary>
 
-Now you're ready to update `app.js` with your code. For example, try this next:
+## 4. Manage domains
+
+The management API is built to work with Databases, S3, etc.
+
+By default, it's just a simple config file and directory.
 
 ```bash
-npm install --save express
+# see which manager and what options are in use
-mkdir -p public
+cat .greenlockrc
-echo '<h1>Hello!</h1>' >> public/index.html
 ```
 
-`app.js`:
+<details>
+<summary>Example Output</summary>
 
-```js
+```json
-'use strict';
+{
-
+    "manager": "greenlock-manager-fs",
-var path = require('path');
+    "configFile": "./greenlock.json"
-var express = require('express');
-var app = express();
-
-app.get('/', express.static(path.join(__dirname, "public")));
-
-module.exports = app;
-
-// for development and debugging
-if (require.main === module) {
-    require('http').createServer(app).listen(3000, function () {
-        console.info("Listening for HTTP on", this.address());
-    });
 }
 ```
 
-# Walkthrough
+</details>
 
-For a more detail read the full
+```bash
-[WALKTHROUGH](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/WALKTHROUGH.md).
+# show the global defaults
+npx greenlock defaults
+```
 
-# Examples
+```js
+var defaults = await greenlock.defaults();
+```
 
-To see all of the examples, just browse [greenlock-express.js/examples/](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples)
+<details>
+<summary>Example Output</summary>
 
-|        Example         | Location + Description                                                                                                                     |
+```json
-| :--------------------: | :----------------------------------------------------------------------------------------------------------------------------------------- |
+{
-|        Express         | [./examples/express/][ex-express] how to export an express app                                                                             |
+    "store": {
-|    Node's **http2**    | [./examples/http2/][ex-http2] how to use Node's built-in http2 server                                                                      |
+        "module": "greenlock-store-fs",
-|      Node's https      | [./examples/https][ex-https] how to customize the https server                                                                             |
+        "basePath": "./greenlock.d"
-|     **WebSockets**     | [./examples/websockets/][ex-websockets] how to use `on('upgrade')`                                                                         |
+    },
-| <span>Socket.IO</span> | [./examples/socket.io][ex-socketio] how to overcomplicate a persistent connection                                                          |
+    "challenges": {
-|        Cluster         | [./examples/cluster/][ex-cluster] how to use Node's built-in clustering with master and worker processes                                   |
+        "http-01": {
-|     **Wildcards**      | [coming someday][ex-wildcards] (ask to help create this) how to use DNS-01 for wildcard certs                                              |
+            "module": "acme-http-01-standalone"
-|     **Localhost**      | [coming someday][ex-localhost] (ask to help create this) how to use DNS-01 for domains that resolve to private networks, such as 127.0.0.1 |
+        }
-|       **CI/CD**        | [coming someday][ex-cicd] (ask to help create this) how to use the `--staging` environment for test deployments                            |
+    },
-|       HTTP Proxy       | [examples/http-proxy][ex-http-proxy] how to (reverse) proxy decrypted traffic to another server                                            |
+    "renewOffset": "-45d",
-|           -            | Build your own<br>Be sure to tell me about it (open an issue)                                                                              |
+    "renewStagger": "3d",
+    "accountKeyType": "EC-P256",
+    "serverKeyType": "RSA-2048",
+    "subscriberEmail": "jon@example.com",
+    "agreeToTerms": true
+}
+```
 
-[ex-express]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/express/
+</details>
-[ex-http2]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http2/
-[ex-https]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/https/
-[ex-websockets]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/websockets/
-[ex-socketio]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/socketo.io/
-[ex-cluster]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/cluster/
-[ex-wildcards]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/wildcards/
-[ex-localhost]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/localhost/
-[ex-cicd]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/ci-cd/
-[ex-http-proxy]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http-proxy/
 
+```bash
+# show per-site configs
+npx greenlock config --subject example.com
+```
 
-# FAQ
+```js
-## 1. But did YOU read the QuickStart?
+greenlock.sites.get({ subject: "example.com" });
+```
 
-99% of the questions I get are answered in the QuickStart, or in the Examples.
+<details>
+<summary>Example Output</summary>
 
-Before you go into your specific use case, just try out the QuickStart from start to finish so that you can see that the default setup works, you get feel for the "lay of the land", and you know what to edit.
+```json
+{
+    "subject": "example.com",
+    "altnames": ["example.com"],
+    "renewAt": 1576638107754,
+    "defaults": {
+        "store": {
+            "module": "greenlock-store-fs",
+            "basePath": "./greenlock.d"
+        },
+        "challenges": {
+            "http-01": {
+                "module": "acme-http-01-standalone"
+            }
+        }
+    }
+}
+```
 
-## 2. How to use JavaScript configuration?
+</details>
 
-You don't. It's JSON on purpose.
+Management can be done via the **CLI** or the JavaScript [**API**](https://git.rootprojects.org/root/greenlock.js).
+Since this is the QuickStart, we'll demo the **CLI**:
 
-The configuration has to be serializable (i.e. could go in a database).
+You need to create a Let's Encrypt _subscriber account_, which can be done globally, or per-site.
+All individuals, and most businesses, should set this globally:
 
-The config file is meant for **simple** use cases, for the average dev and it is managed with `npx greenlock ...`, as shown in the QuickStart.
+```bash
+# Set a global subscriber account
+npx greenlock defaults --subscriber-email 'mycompany@example.com' --agree-to-terms true
+```
 
-If you have a **dynamic** or **advanced** use case (i.e. you need stuff in a database, or to change config on-the-fly), you can use the Greenlock API (not Greenlock Express) and you'll love it.
+```js
+greenlock.manager.defaults({
+    subscriberEmail: "mycompany@example.com",
+    agreeToTerms: true
+});
+```
 
-If you're layering a lot of **complexity** with dev ops tools, but you don't really understand the tools that well (i.e. **Docker**), either use ENVIRONMENT variables or put the `npx greenlock ...` commands in your setup script. You MUST use a database for **lambda** "cloud functions" and such.
+<!-- todo print where the key was saved -->
 
-You can also just mangle the Greenlock API to do what you want... but I don't recommend it. Keep it simple and your future self with thank you.
+A Let's Encrypt SSL certificate has a "Subject" (Primary Domain) and up to 100 "Alternative Names"
+(of which the first _must_ be the subject).
 
-General rule of thumb: commit code, not data / config.
+```bash
+# Add a certificate with specific domains
+npx greenlock add --subject example.com --altnames example.com,www.example.com
+```
 
-## 3. How to use non-standard ports (not 80, 443)?
+```js
+greenlock.sites.add({
+    subject: "example.com",
+    altnames: ["example.com"]
+});
+```
 
-You don't. Not usually.
+<!-- todo print where the cert was saved -->
 
-Let's Encrypt **REQUIRES port 80** for HTTP-01 challenges.
+Note: **Localhost**, **Wildcard**, and Certificates for Private Networks require
+[**DNS validation**](https://git.rootprojects.org/root/greenlock-exp).
 
-But if you're using DNS-01 or you have a proxy in place, just use the raw node server. See these examples:
+-   DNS Validation
+    -   [**Wildcards**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/wildcards/) (coming soon)
+    -   [**Localhost**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/localhost/) (coming soon)
+    -   [**CI/CD**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/ci-cd/) (coming soon)
 
-- [examples/http/server.js](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http/server.js)
+</details>
-- [examples/https/server.js](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/https/server.js)
 
-If you want to use Greenlock as a proxy, see this example:
+# Plenty of Examples
 
-- [examples/http-proxy/server.js](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http-proxy/server.js)
+-   [greenlock-express.js/examples/](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples)
-
+    -   [Express](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/express/)
-# Troubleshooting
+    -   [Node's **http2**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http2/)
-
+    -   [Node's https](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/https/)
-### What if the example didn't work?
+    -   [**WebSockets**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/websockets/)
-
+    -   [Socket.IO](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/socket.io/)
-Double check the following:
+    -   [Cluster](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/cluster/)
-
+    -   [**Wildcards**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/wildcards/) (coming soon)
--   **Public Facing IP** for `http-01` challenges
+    -   [**Localhost**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/localhost/) (coming soon)
-    -   Are you running this _as_ a public-facing webserver (good)? or localhost (bad)?
+    -   [**CI/CD**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/ci-cd/) (coming soon)
-    -   Does `ifconfig` show a public address (good)? or a private one - 10.x, 192.168.x, etc (bad)?
+    -   [HTTP Proxy](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http-proxy/)
-    -   If you're on a non-public server, are you using the `dns-01` challenge?
--   **valid email**
-    -   You MUST set `maintainerEmail` to a **valid address**
-    -   MX records must validate (`dig MX example.com` for `'john@example.com'`)
--   **valid DNS records**
-    -   Must have public DNS records (test with `dig +trace A example.com; dig +trace www.example.com` for `[ 'example.com', 'www.example.com' ]`)
--   **write access**
-    -   You MUST set `configDir` to a writeable location (test with `touch ./greenlock.d/config.json`)
--   **port binding privileges**
-    -   You MUST be able to bind to ports 80 and 443
-    -   You can do this via `sudo` or [`setcap`](https://gist.github.com/firstdoit/6389682)
--   **API limits**
-    -   You MUST NOT exceed the API [**usage limits**](https://letsencrypt.org/docs/staging-environment/) per domain, certificate, IP address, etc
--   **Red Lock, Untrusted**
-    -   You MUST switch from `npm start -- --staging` to `npm start` to use the **production** server
-    -   The API URL should not have 'acme-staging-v02', but should have 'acme-v02'
-
-# Using a Database, S3, etc
-
-If you have a small site, the default file storage will work well for you.
-
-If you have many sites with many users, you'll probably want to store config in a database of some sort.
-
-See the section on **Custom** callbacks and plugins below.
-
-# Advanced Configuration
-
-All of the advanced configuration is done by replacing the default behavior with callbacks.
-
-You can whip up your own, or you can use something that's published to npm.
-
-See the section on **Custom** callbacks and plugins below.
 
 # Easy to Customize
 
@@ -423,40 +429,15 @@ See the section on **Custom** callbacks and plugins below.
 -->
 
 -   [Custom Domain Management](https://git.rootprojects.org/root/greenlock-manager-test.js)
-    -   edit `server.js` and/or `.greenlockrc` to switch from the default `configDir` manager to your config system or database
+    -   `npx greenlock init --manager ./path-or-npm-name.js --manager-FOO 'set option FOO'`
-    -   CLI example: `npx greenlock init --manager ./path-or-npm-name.js --manager-FOO 'set option FOO'`
 -   [Custom Key & Cert Storage](https://git.rootprojects.org/root/greenlock-store-test.js)
-    -   edit the `defaults` section of `greenlock.d/config.json` to change the certificate store or database
+    -   `npx greenlock defaults --store greenlock-store-fs --store-base-path ./greenlock.d`
-    -   CLI example: `npx greenlock defaults --store greenlock-store-fs --store-base-path ./greenlock.d`
 -   [Custom ACME HTTP-01 Challenges](https://git.rootprojects.org/root/acme-http-01-test.js)
-    -   edit the `defaults` section of `greenlock.d/config.json` to change the challenges by hand
+    -   `npx greenlock defaults --challenge-http-01 ./you-http-01.js`
-    -   CLI example: `npx greenlock defaults --challenge-http-01 ./you-http-01.js`
+    -   `npx greenlock update --subject example.com --challenge-http-01 acme-http-01-standalone`
 -   [Custom ACME DNS-01 Challenges](https://git.rootprojects.org/root/acme-dns-01-test.js)
-    -   edit the `defaults` section of `greenlock.d/config.json` to change the challenges by hand
+    -   `npx greenlock defaults --challenge-dns-01 acme-dns-01-ovh --challenge-dns-01-token xxxx`
-    -   CLI example: `npx greenlock defaults --challenge-dns-01 acme-dns-01-ovh --challenge-dns-01-token xxxx`
+    -   `npx greenlock update --subject example.com --challenge-dns-01 ./your-dns-01.js
-    -   Per-site example: `npx greenlock update --subject example.com --challenge-dns-01 ./your-dns-01.js`
-    -   API example:
-        ```js
-        greenlock.sites.set({
-            subject: "example.com",
-            challenges: {
-                "dns-01": {
-                    module: "my-npm-module-name",
-                    foo: "some option",
-                    bar: "some other option"
-                }
-            }
-        });
-        ```
-
-If you're using the default `configDir` management you can edit `greenlock.d/config.json` by hand to change
-which default and per-site modules are used.
-
-You can use the CLI, even if you're using a database, buckets, or your own file storage.
-
-You can also use the API, particularly if you need to set values dynamically per-site or per-user
-rather than using the global defaults. The certificate store and all challenges can be set
-per-site, but most per-site use cases are for DNS-01.
 
 # Ready-made Integrations
 
@@ -534,3 +515,4 @@ attribution, and/or visible source policies. We want to build great software and
 MPL-2.0 |
 [Terms of Use](https://therootcompany.com/legal/#terms) |
 [Privacy Policy](https://therootcompany.com/legal/#privacy)
+[Privacy Policy](https://therootcompany.com/legal/#privacy)

WALKTHROUGH.md

@@ -1,256 +0,0 @@
-# Greenlock Express Walkthrough
-
-This will show you the basics of how to
-
-1. Create a node project
-2. Create an http app (i.e. express)
-3. Serve with Greenlock Express
-4. Manage SSL Certificates and Domains
-
-## 1. Create a node project
-
-Create an empty node project.
-
-Be sure to fill out the package name, version, and an author email.
-
-```bash
-mkdir ~/my-project
-pushd ~/my-project
-npm init
-```
-
-## 2. Create an http app (i.e. express)
-
-This example is shown with Express, but any node app will do. Greenlock
-works with everything.
-(or any node-style http app)
-
-`my-express-app.js`:
-
-```js
-"use strict";
-
-// A plain, node-style app
-
-function myPlainNodeHttpApp(req, res) {
-    res.end("Hello, Encrypted World!");
-}
-
-// Wrap that plain app in express,
-// because that's what you're used to
-
-var express = require("express");
-var app = express();
-app.get("/", myPlainNodeHttpApp);
-
-// export the app normally
-// do not .listen()
-
-module.exports = app;
-```
-
-## 3. Serve with Greenlock Express
-
-Greenlock Express is designed with these goals in mind:
-
--   Simplicity and ease-of-use
--   Performance and scalability
--   Configurability and control
-
-You can start with **near-zero configuration** and
-slowly add options for greater performance and customization
-later, if you need them.
-
-`server.js`:
-
-```js
-"use strict";
-
-//var pkg = require("./package.json");
-var app = require("./app.js");
-
-require("greenlock-express")
-    .init({
-        // where to find .greenlockrc and set default paths
-        packageRoot: __dirname,
-
-        // where config and certificate stuff go
-        configDir: "./greenlock.d",
-
-        // contact for security and critical bug notices
-        maintainerEmail: pkg.author,
-
-        // name & version for ACME client user agent
-        //packageAgent: pkg.name + "/" + pkg.version,
-
-        // whether or not to run at cloudscale
-        cluster: false
-    })
-    .serve(app);
-```
-
-And start your server:
-
-```bash
-# Allow non-root node to use ports 80 (HTTP) and 443 (HTTPS)
-sudo setcap 'cap_net_bind_service=+ep' $(which node)
-```
-
-```bash
-# `npm start` will call `node ./server.js` by default
-npm start
-```
-
-```bash
-# use --staging to use the development API until you're ready to get real certificates
-npm start -- --staging
-```
-
-```txt
-Greenlock v4.0.0
-Greenlock Config Dir/File: ./greenlock.d/config.json
-
-Listening on 0.0.0.0:80 for ACME challenges and HTTPS redirects
-Listening on 0.0.0.0:443 for secure traffic
-```
-
-## 4. Manage SSL Certificates and Domains
-
-The management API is built to work with Databases, S3, etc.
-
-By default, it's just a simple config file and directory.
-
-```bash
-# see which manager and what options are in use
-cat .greenlockrc
-```
-
-<details>
-<summary>Example Output</summary>
-
-```json
-{
-    "manager": {
-        "module": "@greenlock/manager"
-    },
-    "configDir": "./greenlock.d"
-}
-```
-
-</details>
-
-```bash
-# show the global defaults with the CLI
-npx greenlock defaults
-```
-
-```js
-// show the global defaults with the API
-var defaults = await greenlock.defaults();
-```
-
-<details>
-<summary>Example Output</summary>
-
-```json
-{
-    "store": {
-        "module": "greenlock-store-fs",
-        "basePath": "./greenlock.d"
-    },
-    "challenges": {
-        "http-01": {
-            "module": "acme-http-01-standalone"
-        }
-    },
-    "renewOffset": "-45d",
-    "renewStagger": "3d",
-    "accountKeyType": "EC-P256",
-    "serverKeyType": "RSA-2048",
-    "subscriberEmail": "jon@example.com",
-    "agreeToTerms": true
-}
-```
-
-</details>
-
-```bash
-# show per-site configs with the CLI
-npx greenlock config --subject example.com
-```
-
-```js
-// show a site config with the API
-greenlock.sites.get({ subject: "example.com" });
-```
-
-<details>
-<summary>Example Output</summary>
-
-```json
-{
-    "subject": "example.com",
-    "altnames": ["example.com"],
-    "renewAt": 1576638107754,
-    "defaults": {
-        "store": {
-            "module": "greenlock-store-fs",
-            "basePath": "./greenlock.d"
-        },
-        "challenges": {
-            "http-01": {
-                "module": "acme-http-01-standalone"
-            }
-        }
-    }
-}
-```
-
-</details>
-
-Management can be done via the **CLI** or the JavaScript [**API**](https://git.rootprojects.org/root/greenlock.js).
-Since this is the QuickStart, we'll demo the **CLI**:
-
-You need to create a Let's Encrypt _subscriber account_, which can be done globally, or per-site.
-All individuals, and most businesses, should set this globally:
-
-```bash
-# Set a global subscriber account with the CLI
-npx greenlock defaults --subscriber-email 'mycompany@example.com' --agree-to-terms true
-```
-
-```js
-// set a global subscriber account with the API
-greenlock.manager.defaults({
-    subscriberEmail: "mycompany@example.com",
-    agreeToTerms: true
-});
-```
-
-<!-- todo print where the key was saved -->
-
-A Let's Encrypt SSL certificate has a "Subject" (Primary Domain) and up to 100 "Alternative Names"
-(of which the first _must_ be the subject).
-
-```bash
-# Add a certificate with specific domains with the CLI
-npx greenlock add --subject example.com --altnames example.com,www.example.com
-```
-
-```js
-// Add a certificate with specific domains with the API
-greenlock.sites.add({
-    subject: "example.com",
-    altnames: ["example.com"]
-});
-```
-
-<!-- todo print where the cert was saved -->
-
-Note: **Localhost**, **Wildcard**, and Certificates for Private Networks require
-[**DNS validation**](https://git.rootprojects.org/root/greenlock-exp).
-
--   DNS Validation
-    -   [**Wildcards**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/wildcards/) (coming soon)
-    -   [**Localhost**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/localhost/) (coming soon)
-    -   [**CI/CD**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/ci-cd/) (coming soon)

examples/cluster/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "cluster-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/cluster/server.js

@@ -1,27 +1,25 @@
 "use strict";
 
+var pkg = require("../../package.json");
 //require("greenlock-express")
 require("../../")
-    .init({
+    .init(function getConfig() {
-        packageRoot: __dirname,
+        // Greenlock Config
-        configDir: "./greenlock.d",
 
-        maintainerEmail: "jon@example.com",
+        return {
+            package: { name: "websocket-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
 
-        // When you're ready to go full cloud scale, you just change this to true:
+            // When you're ready to go full cloud scale, you just change this to true:
-        // Note: in cluster you CANNOT use in-memory state (see below)
+            // Note: in cluster you CANNOT use in-memory state (see below)
-        cluster: true,
+            cluster: true,
 
-        // This will default to the number of workers being equal to
+            // This will default to the number of workers being equal to
-        // n-1 cpus, with a minimum of 2
+            // n-1 cpus, with a minimum of 2
-        workers: 4
+            workers: 4
+        };
     })
-    // ready is only executed by workers (no-op in master)
+    .serve(httpsWorker);
-    .ready(httpsWorker)
-    // master is only executed by master (no-op in a worker)
-    .master(function() {
-        console.info("I'm the master");
-    });
 
 function httpsWorker(glx) {
     // WRONG

examples/express/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "express-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/express/server.js

@@ -1,22 +1,27 @@
 "use strict";
 
-var app = require("./my-express-app.js");
+function httpsWorker(glx) {
+    var app = require("./my-express-app.js");
 
-app.get("/hello", function(req, res) {
+    app.get("/hello", function(req, res) {
-    res.end("Hello, Encrypted World!");
+        res.end("Hello, Encrypted World!");
-});
+    });
-
-//require("greenlock-express")
-require("../../")
-    .init({
-        packageRoot: __dirname,
-        configDir: "./greenlock.d",
-
-        maintainerEmail: "jon@example.com",
-
-        cluster: false
-    })
 
     // Serves on 80 and 443
     // Get's SSL certificates magically!
-    .serve(app);
+    glx.serveApp(app);
+}
+
+var pkg = require("../../package.json");
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            package: { name: "http2-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

examples/http-proxy/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "http-proxy-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/http-proxy/server.js

@@ -1,21 +1,5 @@
 "use strict";
 
-//require("greenlock-express")
-require("../../")
-    .init(function getConfig() {
-        // Greenlock Config
-
-        return {
-            packageRoot: __dirname,
-            configDir: "./greenlock.d",
-
-            maintainerEmail: "jon@example.com",
-
-            cluster: false
-        };
-    })
-    .ready(httpsWorker);
-
 function httpsWorker(glx) {
     // we need the raw https server
     var server = glx.httpsServer();
@@ -44,3 +28,17 @@ function httpsWorker(glx) {
         });
     });
 }
+
+var pkg = require("../../package.json");
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            package: { name: "http-proxy-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

examples/http/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "http-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/http/server.js

@@ -1,24 +1,15 @@
 "use strict";
 
+var pkg = require("../../package.json");
+
 // The WRONG way:
 //var http = require('http');
-//var httpServer = http.createServer(redirectToHttps);
+//var httpServer = https.createSecureServer(redirectToHttps);
 //
 // Why is that wrong?
 // Greenlock needs to change some low-level http and https options.
 // Use glx.httpServer(redirectToHttps) instead.
 
-//require("greenlock-express")
-require("../../")
-    .init({
-        packageRoot: __dirname,
-        configDir: "./greenlock.d",
-
-        maintainerEmail: "jon@example.com",
-        cluster: false
-    })
-    .ready(httpsWorker);
-
 function httpsWorker(glx) {
     //
     // HTTP can only be used for ACME HTTP-01 Challenges
@@ -36,3 +27,16 @@ function httpsWorker(glx) {
         console.info("Listening on ", httpServer.address());
     });
 }
+
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            package: { name: "plain-http-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

examples/http2/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "http2-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/http2/server.js

@@ -1,5 +1,7 @@
 "use strict";
 
+var pkg = require("../../package.json");
+
 // The WRONG way:
 //var http2 = require('http2');
 //var http2Server = https.createSecureServer(tlsOptions, app);
@@ -8,17 +10,6 @@
 // Greenlock needs to change some low-level http and https options.
 // Use glx.httpsServer(tlsOptions, app) instead.
 
-//require("greenlock-express")
-require("../../")
-    .init({
-        packageRoot: __dirname,
-        configDir: "./greenlock.d",
-
-        maintainerEmail: "jon@example.com",
-        cluster: false
-    })
-    .ready(httpsWorker);
-
 function httpsWorker(glx) {
     //
     // HTTP2 would have been the default httpsServer for node v12+
@@ -26,8 +17,7 @@ function httpsWorker(glx) {
     //
 
     // Get the raw http2 server:
-    var tlsOptions = null;
+    var http2Server = glx.http2Server(function(req, res) {
-    var http2Server = glx.http2Server(tlsOptions, function(req, res) {
         res.end("Hello, Encrypted World!");
     });
 
@@ -39,8 +29,20 @@ function httpsWorker(glx) {
     // You must ALSO listen on port 80 for ACME HTTP-01 Challenges
     // (the ACME and http->https middleware are loaded by glx.httpServer)
     var httpServer = glx.httpServer();
-
     httpServer.listen(80, "0.0.0.0", function() {
         console.info("Listening on ", httpServer.address());
     });
 }
+
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            package: { name: "http2-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

examples/https/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "https1-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/https/server.js

@@ -1,5 +1,7 @@
 "use strict";
 
+var pkg = require("../../package.json");
+
 // The WRONG way:
 //var https = require('https');
 //var httpsServer = https.createServer(tlsOptions, app);
@@ -8,17 +10,6 @@
 // Greenlock needs to change some low-level http and https options.
 // Use glx.httpsServer(tlsOptions, app) instead.
 
-//require("greenlock-express")
-require("../../")
-    .init({
-        packageRoot: __dirname,
-        configDir: "./greenlock.d",
-
-        maintainerEmail: "jon@example.com",
-        cluster: false
-    })
-    .ready(httpsWorker);
-
 function httpsWorker(glx) {
     //
     // HTTPS 1.1 is the default
@@ -38,8 +29,20 @@ function httpsWorker(glx) {
     // You must ALSO listen on port 80 for ACME HTTP-01 Challenges
     // (the ACME and http->https middleware are loaded by glx.httpServer)
     var httpServer = glx.httpServer();
-
     httpServer.listen(80, "0.0.0.0", function() {
         console.info("Listening on ", httpServer.address());
     });
 }
+
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            package: { name: "https1-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

examples/quickstart/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "quickstart-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/quickstart/server.js

@@ -1,27 +1,32 @@
 "use strict";
 
-// This can be a node http app (shown),
+function httpsWorker(glx) {
-// an Express app, or Hapi, Koa, Rill, etc
+    // This can be a node http app (shown),
-var app = function(req, res) {
+    // an Express app, or Hapi, Koa, Rill, etc
-    res.end("Hello, Encrypted World!");
+    var app = function(req, res) {
-};
+        res.end("Hello, Encrypted World!");
-
+    };
-//require("greenlock-express")
-require("../../")
-    .init({
-        // Package name+version are taken from <packageRoot>/package.json and used for ACME client user agent
-        packageRoot: __dirname,
-        // configDir is relative to packageRoot, not _this_ file
-        configDir: "./greenlock.d",
-
-        // Maintainer email is the contact for critical bug and security notices
-        // by default package.json.author.email will be used
-        //maintainerEmail: "jon@example.com",
-
-        // Change to true when you're ready to make your app cloud-scale
-        cluster: false
-    })
 
     // Serves on 80 and 443
     // Get's SSL certificates magically!
-    .serve(app);
+    glx.serveApp(app);
+}
+
+var pkg = require("../../package.json");
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            // Package name+version is used for ACME client user agent
+            package: { name: "websocket-example", version: pkg.version },
+
+            // Maintainer email is the contact for critical bug and security notices
+            maintainerEmail: "jon@example.com",
+
+            // Change to true when you're ready to make your app cloud-scale
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

examples/socket.io/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "socket-io-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/socket.io/server.js

@@ -8,17 +8,6 @@
 //       You can just use WebSockets
 //       (see the websocket example)
 
-//require("greenlock-express")
-require("../../")
-    .init({
-        packageRoot: __dirname,
-        configDir: "./greenlock.d",
-
-        maintainerEmail: "jon@example.com",
-        cluster: false
-    })
-    .ready(httpsWorker);
-
 function httpsWorker(glx) {
     var socketio = require("socket.io");
     var io;
@@ -44,3 +33,17 @@ function httpsWorker(glx) {
         res.end("Hello, World!\n\n💚 🔒.js");
     });
 }
+
+var pkg = require("../../package.json");
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            package: { name: "socket-io-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

examples/websockets/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "websockets-example",
-  "version": "1.0.0",
-  "description": "",
-  "main": "server.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node server.js"
-  },
-  "author": "John Doe <j.doe@example.com> (https://example.com/)",
-  "license": "ISC"
-}

examples/websockets/server.js

@@ -1,16 +1,5 @@
 "use strict";
 
-//require("greenlock-express")
-require("../../")
-    .init({
-        packageRoot: __dirname,
-        configDir: "./greenlock.d",
-
-        maintainerEmail: "jon@example.com",
-        cluster: false
-    })
-    .ready(httpsWorker);
-
 function httpsWorker(glx) {
     // we need the raw https server
     var server = glx.httpsServer();
@@ -37,3 +26,17 @@ function httpsWorker(glx) {
         res.end("Hello, World!\n\n💚 🔒.js");
     });
 }
+
+var pkg = require("../../package.json");
+//require("greenlock-express")
+require("../../")
+    .init(function getConfig() {
+        // Greenlock Config
+
+        return {
+            package: { name: "websocket-example", version: pkg.version },
+            maintainerEmail: "jon@example.com",
+            cluster: false
+        };
+    })
+    .serve(httpsWorker);

greenlock-express.js

@@ -17,20 +17,14 @@ var GLE = module.exports;
 // under the hood. That's the hope, anyway.
 
 GLE.init = function(fn) {
-    // See https://git.coolaj86.com/coolaj86/greenlock-express.js/issues/80
+    if (cluster.isWorker) {
-    if (fn && false !== fn.cluster && cluster.isWorker) {
         // ignore the init function and launch the worker
         return require("./worker.js").create();
     }
 
-    var opts;
+    var opts = fn();
-    if ("function" === typeof fn) {
-        opts = fn();
-    } else if ("object" === typeof fn) {
-        opts = fn;
-    }
     if (!opts || "object" !== typeof opts) {
-        throw new Error("the `Greenlock.init(fn)` function should return an object `{ packageRoot, cluster }`");
+        throw new Error("the `Greenlock.init(fn)` function should return an object `{ greenlock, cluster }`");
     }
 
     // just for ironic humor

greenlock-shim.js

@@ -2,33 +2,19 @@
 
 module.exports.create = function(opts) {
     var Greenlock = require("@root/greenlock");
-    //var Init = require("@root/greenlock/lib/init.js");
     var greenlock = opts.greenlock;
 
-    /*
-    if (!greenlock && opts.packageRoot) {
-        try {
-            greenlock = require(path.resolve(opts.packageRoot, "greenlock.js"));
-        } catch (e) {
-            if ("MODULE_NOT_FOUND" !== e.code) {
-                throw e;
-            }
-        }
-    }
-    */
-
     if (!greenlock) {
-        //opts = Init._init(opts);
+        opts = parsePackage(opts);
+        opts.packageAgent = addGreenlockAgent(opts);
         greenlock = Greenlock.create(opts);
-    }
+        try {
-    opts.packageAgent = addGreenlockAgent(opts);
+            if (opts.notify) {
-
+                greenlock._defaults.notify = opts.notify;
-    try {
+            }
-        if (opts.notify) {
+        } catch (e) {
-            greenlock._defaults.notify = opts.notify;
+            console.error("Developer Error: notify not attached correctly");
         }
-    } catch (e) {
-        console.error("Developer Error: notify not attached correctly");
     }
 
     // re-export as top-level function to simplify rpc with workers
@@ -38,14 +24,11 @@ module.exports.create = function(opts) {
 
     greenlock._find({}).then(function(sites) {
         if (sites.length <= 0) {
-            console.warn("Warning: `find({})` returned 0 sites.");
+            console.warn("warning: No sites available. Did you add them?");
-            console.warn("         Does `" + greenlock.manager._modulename + "` implement `find({})`?");
-            console.warn("         Did you add sites?");
             console.warn("         npx greenlock add --subject example.com --altnames example.com");
             return;
         }
         console.info("Ready to Serve:");
-
         var max = 3;
         if (sites.length >= 1) {
             sites.slice(0, max).forEach(function(site) {
@@ -70,3 +53,53 @@ function addGreenlockAgent(opts) {
 
     return packageAgent.trim();
 }
+
+// ex: "John Doe <john@example.com> (https://john.doe)"
+// ex: "John Doe <john@example.com>"
+// ex: "<john@example.com>"
+// ex: "john@example.com"
+var looseEmailRe = /(^|[\s<])([^'" <>:;`]+@[^'" <>:;`]+\.[^'" <>:;`]+)/;
+function parsePackage(opts) {
+    // 'package' is sometimes a reserved word
+    var pkg = opts.package || opts.pkg;
+    if (!pkg) {
+        opts.maintainerEmail = parseMaintainer(opts.maintainerEmail);
+        return opts;
+    }
+
+    if (!opts.packageAgent) {
+        var err = "missing `package.THING`, which is used for the ACME client user agent string";
+        if (!pkg.name) {
+            throw new Error(err.replace("THING", "name"));
+        }
+        if (!pkg.version) {
+            throw new Error(err.replace("THING", "version"));
+        }
+        opts.packageAgent = pkg.name + "/" + pkg.version;
+    }
+
+    if (!opts.maintainerEmail) {
+        try {
+            opts.maintainerEmail = pkg.author.email || pkg.author.match(looseEmailRe)[2];
+        } catch (e) {}
+    }
+    if (!opts.maintainerEmail) {
+        throw new Error("missing or malformed `package.author`, which is used as the contact for support notices");
+    }
+    opts.package = undefined;
+    opts.maintainerEmail = parseMaintainer(opts.maintainerEmail);
+
+    return opts;
+}
+
+function parseMaintainer(maintainerEmail) {
+    try {
+        maintainerEmail = maintainerEmail.match(looseEmailRe)[2];
+    } catch (e) {
+        maintainerEmail = null;
+    }
+    if (!maintainerEmail) {
+        throw new Error("missing or malformed `maintainerEmail`, which is used as the contact for support notices");
+    }
+    return maintainerEmail;
+}

master.js

@@ -48,12 +48,10 @@ Master.create = function(opts) {
             kickoff();
             resolveCb(fn);
             return master;
-        },
-        serve: function(fn) {
-            // ignore
-            master.ready(fn);
         }
     };
+    // backwards compat starts early...
+    master.serve = master.ready;
     return master;
 };
 

package-lock.json

@@ -1,27 +1,26 @@
 {
     "name": "@root/greenlock-express",
-    "version": "4.0.4",
+    "version": "3.1.0",
     "lockfileVersion": 1,
     "requires": true,
     "dependencies": {
         "@greenlock/manager": {
-            "version": "3.1.0",
+            "version": "3.0.0",
-            "resolved": "https://registry.npmjs.org/@greenlock/manager/-/manager-3.1.0.tgz",
+            "resolved": "https://registry.npmjs.org/@greenlock/manager/-/manager-3.0.0.tgz",
-            "integrity": "sha512-PBy5CMK+j4oD7sj7hF5qE+xKEOSiiuL2hHd5X5ttEbtnTSDKjNeqbrR5k2ZddwVNdjOVeBIeuqlm81IFZ+Ftew==",
+            "integrity": "sha512-ijgJrFdzJPmzrDk8aKXYoYR8LNfG3hXd9/s54ZY7IgxTulyPQ/qOPgl7sWgCxxLhZBzSY1xI6eC/6Y5TQ01agg==",
             "requires": {
-                "greenlock-manager-fs": "^3.1.0"
+                "greenlock-manager-fs": "^3.0.5"
             }
         },
         "@root/acme": {
-            "version": "3.1.0",
+            "version": "3.0.8",
-            "resolved": "https://registry.npmjs.org/@root/acme/-/acme-3.1.0.tgz",
+            "resolved": "https://registry.npmjs.org/@root/acme/-/acme-3.0.8.tgz",
-            "integrity": "sha512-GAyaW63cpSYd2KvVp5lHLbCWeEhJPKZK9nsJvZJOKsD9Uv88KEttn4FpDZEJ+2q3Jsey0DWpuQ2I4ft0JV9p2w==",
+            "integrity": "sha512-VmBvLvWdCDkolkanI9Dzm1ouSWPaAa2eCCwcDZcVQbWoNiUIOqbbd57fcMA/gZxLyuJPStD2WXFuEuSMPDxcww==",
             "requires": {
-                "@root/csr": "^0.8.1",
                 "@root/encoding": "^1.0.1",
-                "@root/keypairs": "^0.10.0",
+                "@root/keypairs": "^0.9.0",
                 "@root/pem": "^1.0.4",
-                "@root/request": "^1.6.1",
+                "@root/request": "^1.3.11",
                 "@root/x509": "^0.7.2"
             }
         },
@@ -49,26 +48,27 @@
             "integrity": "sha512-OaEub02ufoU038gy6bsNHQOjIn8nUjGiLcaRmJ40IUykneJkIW5fxDqKxQx48cszuNflYldsJLPPXCrGfHs8yQ=="
         },
         "@root/greenlock": {
-            "version": "4.0.5",
+            "version": "3.1.3",
-            "resolved": "https://registry.npmjs.org/@root/greenlock/-/greenlock-4.0.5.tgz",
+            "resolved": "https://registry.npmjs.org/@root/greenlock/-/greenlock-3.1.3.tgz",
-            "integrity": "sha512-KR9w3mYE9aH33FCibI8oSYBQV+f7lc3MVPdZ9nxY2tqRLmJp05cMOMz340mtG14VnWDuznLj4TbBj3sHIuoQPQ==",
+            "integrity": "sha512-9Rj9JIKYItOvZKbPa5JrljS74dw+KjltOyQnb14y4nX89C+s1mZjv3Qiv1cNuYkYCmBGR77z0/cKnfUUaWxkag==",
             "requires": {
-                "@greenlock/manager": "^3.1.0",
+                "@greenlock/manager": "^3.0.0",
-                "@root/acme": "^3.1.0",
+                "@root/acme": "^3.0.8",
                 "@root/csr": "^0.8.1",
-                "@root/keypairs": "^0.10.0",
+                "@root/keypairs": "^0.9.0",
                 "@root/mkdirp": "^1.0.0",
-                "@root/request": "^1.6.1",
+                "@root/request": "^1.3.10",
                 "acme-http-01-standalone": "^3.0.5",
                 "cert-info": "^1.5.1",
-                "greenlock-store-fs": "^3.2.2",
+                "greenlock-manager-fs": "^3.0.5",
+                "greenlock-store-fs": "^3.2.0",
                 "safe-replace": "^1.1.0"
             }
         },
         "@root/keypairs": {
-            "version": "0.10.0",
+            "version": "0.9.0",
-            "resolved": "https://registry.npmjs.org/@root/keypairs/-/keypairs-0.10.0.tgz",
+            "resolved": "https://registry.npmjs.org/@root/keypairs/-/keypairs-0.9.0.tgz",
-            "integrity": "sha512-t8VocY46Mtb0NTsxzyLLf5tsgfw0BXLYVADAyiRdEdqHcvPFGJdjkXNtHVQuSV/FMaC65iTOHVP4E6X8iT3Ikg==",
+            "integrity": "sha512-NXE2L9Gv7r3iC4kB/gTPZE1vO9Ox/p14zDzAJ5cGpTpytbWOlWF7QoHSJbtVX4H7mRG/Hp7HR3jWdWdb2xaaXg==",
             "requires": {
                 "@root/encoding": "^1.0.1",
                 "@root/pem": "^1.0.4",
@@ -86,9 +86,9 @@
             "integrity": "sha512-rEUDiUsHtild8GfIjFE9wXtcVxeS+ehCJQBwbQQ3IVfORKHK93CFnRtkr69R75lZFjcmKYVc+AXDB+AeRFOULA=="
         },
         "@root/request": {
-            "version": "1.6.1",
+            "version": "1.4.2",
-            "resolved": "https://registry.npmjs.org/@root/request/-/request-1.6.1.tgz",
+            "resolved": "https://registry.npmjs.org/@root/request/-/request-1.4.2.tgz",
-            "integrity": "sha512-8wrWyeBLRp7T8J36GkT3RODJ6zYmL0/maWlAUD5LOXT28D3TDquUepyYDKYANNA3Gc8R5ZCgf+AXvSTYpJEWwQ=="
+            "integrity": "sha512-J8FM4+SJuc7WRC+Jz17m+VT2lgI7HtatHhxN1F2ck5aIKUAxJEaR4u/gLBsgT60mVHevKCjKN0O8115UtJjwLw=="
         },
         "@root/x509": {
             "version": "0.7.2",
@@ -115,9 +115,9 @@
             "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
         },
         "greenlock-manager-fs": {
-            "version": "3.1.1",
+            "version": "3.0.5",
-            "resolved": "https://registry.npmjs.org/greenlock-manager-fs/-/greenlock-manager-fs-3.1.1.tgz",
+            "resolved": "https://registry.npmjs.org/greenlock-manager-fs/-/greenlock-manager-fs-3.0.5.tgz",
-            "integrity": "sha512-np6qdnPIOZx40PAcSQcqK1eMPWjTKxsxcgRd/OVg0ai49WC1Ds74CTrwmB84pq2n53ikbnDBQFmKEQ4AC0DK8w==",
+            "integrity": "sha512-r/q+tEFuDwklfzPfiGhcIrHuJxMrppC+EseESpu5f0DMokh+1iZVm9nGC/VE7/7GETdOYfEYhhQkmspsi8Gr/A==",
             "requires": {
                 "@root/mkdirp": "^1.0.0",
                 "safe-replace": "^1.1.0"
@@ -133,9 +133,9 @@
             }
         },
         "redirect-https": {
-            "version": "1.3.1",
+            "version": "1.3.0",
-            "resolved": "https://registry.npmjs.org/redirect-https/-/redirect-https-1.3.1.tgz",
+            "resolved": "https://registry.npmjs.org/redirect-https/-/redirect-https-1.3.0.tgz",
-            "integrity": "sha512-Stex2nI+tMpZXKvy++32TiBXEy+GdpAfp3EUnl5BqCiJ5f5i6XvUSFrs7TR7IoRSlthM7ZtD89uYGTtJBXlFYg==",
+            "integrity": "sha512-9GzwI/+Cqw3jlSg0CW6TgBQbhiVhkHSDvW8wjgRQ9IK34wtxS71YJiQeazSCSEqbvowHCJuQZgmQFl1xUHKEgg==",
             "requires": {
                 "escape-html": "^1.0.3"
             }

package.json

@@ -1,6 +1,6 @@
 {
     "name": "@root/greenlock-express",
-    "version": "4.0.4",
+    "version": "3.1.0",
     "description": "Free SSL and managed or automatic HTTPS for node.js with Express, Koa, Connect, Hapi, and all other middleware systems.",
     "main": "greenlock-express.js",
     "homepage": "https://greenlock.domains",
@@ -17,8 +17,8 @@
         "example": "examples"
     },
     "dependencies": {
-        "@root/greenlock": "^4.0.5",
+        "@root/greenlock": "^3.1.3",
-        "redirect-https": "^1.3.1"
+        "redirect-https": "^1.1.5"
     },
     "trulyOptionalDependencies": {
         "http-proxy": "^1.17.0",

single.js

@@ -19,18 +19,9 @@ Single.create = function(opts) {
             // ignore
             //fn(master);
             return single;
-        },
-        serve: function(fn) {
-            // keeping backwards compat
-            if (1 === fn.length) {
-                single.ready(fn);
-                return;
-            }
-            // serving the app, right away
-            single.ready(function(glx) {
-                glx.serveApp(fn);
-            });
         }
     };
+    // backwards compat starts now
+    single.serve = single.ready;
     return single;
 };

worker.js

@@ -22,19 +22,10 @@ Worker.create = function() {
         master: function() {
             // ignore
             return worker;
-        },
-        serve: function(fn) {
-            // keeping backwards compat
-            if (1 === fn.length) {
-                worker.ready(fn);
-                return;
-            }
-            // serving the express app, right away
-            worker.ready(function(glx) {
-                glx.serveApp(fn);
-            });
         }
     };
+    // backwards compat starts early...
+    worker.serve = worker.ready;
     return worker;
 };