v0.27.1

docs/ACME_PROVIDERS.md

@@ -26,16 +26,23 @@ certificate to a vhost. No CA operation occurs on startup or merely opening a fo
 | PEM import | Upload fullchain/certificate and corresponding private key, then validate |
 | Existing server files | Advanced: reference a PEM pair already in the certificate directory |
 
-Python 3 and Certbot must be executable by the RustProxy service user. Install
-plugins in that SAME Certbot environment. The application does not install packages
-or execute sudo. Check the CLI installation with `bash dev.sh acme --doctor` and
-`certbot plugins`; this does not validate provider credentials or DNS reachability.
-DNS uses the API/plugin appropriate to the selected provider, not a Cloudflare
-Tunnel integration or a hand-written replacement for ACME.
+RustProxy now owns its preferred Certbot environment under `<data-dir>/acme-python`.
+When it is missing, RustProxy creates a virtual environment and installs pinned Certbot
+5.8.0 plus `certbot-dns-cloudflare`, `certbot-dns-ovh` and
+`certbot-dns-rfc2136` 5.8.0 with pip. No distribution Python files are modified and
+RustProxy never executes sudo. If the stdlib `venv` module is unavailable but system
+pip works, `virtualenv` is bootstrapped only inside the RustProxy data directory.
 
-The shipped OCI image already contains Certbot plus the Cloudflare, OVH and RFC2136
-plugins in one dedicated Python environment. Host/source installations remain under
-the operator's package-management policy and must provide the plugins they use.
+If local setup fails, a runnable system `certbot` from `PATH` is used as fallback. The
+Certificates panel reports whether the managed environment, the system fallback, or no
+ACME runtime is active. Systems without Python (for example some appliance layouts)
+retain PEM import and existing-file certificate modes even though ACME issuance/renewal
+is unavailable. `bash dev.sh acme --doctor` and `certbot plugins` inspect only the
+current shell/system fallback; they do not validate provider credentials or DNS reachability.
+
+The shipped OCI image contains Python, venv/pip and distribution Certbot packages as an
+offline fallback. Its preferred managed environment is still created in the persisted
+`/var/lib/rustproxy` data volume.
 
 ## HTTP-01 requirements and scope