v0.24.9

docs/ACME_RFC2136.md

@@ -96,16 +96,17 @@ can leave challenge TXT records: inspect DNS and clean only the failed challenge
 values, not unrelated records. Only the latest job status lives in memory; restart
 loses that status, not the private Certbot files.
 
-TSIG is supplied through stdin to the helper, never argv, SQLite, exports or job
-responses. The browser clears the secret field after submission and does not put
-it in local/session storage. Private credentials/account files are deliberately
-retained for renewal; protect them and private logs as secrets. Keep unused staged
-pairs under operator control; active files are never silently deleted.
+TSIG/API credentials are supplied through stdin to the helper, never argv, exports
+or job responses. RustProxy encrypts DNS-provider credentials in the Secret Store;
+Certbot-compatible `.ini` files are recreated with private permissions only for the
+external operation and removed afterwards. The browser clears submitted secret
+fields and does not put them in local/session storage. Protect the Certbot account
+state and private logs as secrets.
 
-The existing `dev.sh backup` includes SQLite and configured PEM files, **not the
-ACME account/profile directory**. Back up `certs/acme` separately while no issuance
-is active, preserving ownership/modes and encryption appropriate to private keys.
-Source upgrade leaves the data directory alone. Do not ship profiles in source ZIPs.
+Use `rust-proxy backup create` for current installations. The encrypted full backup
+includes the durable ACME profile/account state, certificates and Secret Store key
+material needed for renewal. The historical `dev.sh backup` helper is not sufficient
+after Secret Store migration. See SECRET_STORE_BACKUP.md.
 
 ## API and local helper