Initialize modular NPM ACME authority patcher

README.md

@@ -0,0 +1,52 @@
+# NPM ACME Authority
+
+Runtime ACME write fencing for Nginx Proxy Manager.
+
+The project patches NPM certificate handling at container startup so that
+selected Let's Encrypt mutation paths require a Pacemaker-controlled
+authority token.
+
+## Gate configuration
+
+- `ACME_GATE_REQUEST=true`
+- `ACME_GATE_RENEW=true`
+- `ACME_GATE_REVOKE=true`
+
+These variables determine which ACME operations require authority.
+
+They do **not** grant authority.
+
+## Runtime authority
+
+Authority is represented by:
+
+    /acme_authority/state/acme-authority
+
+The intended production mapping is:
+
+    /etc/npm-acme-authority  -> /acme_authority
+    /run/npm-acme-authority -> /acme_authority/state
+
+The persistent code mount is read-only.
+
+The runtime state mount is read-only from the container's perspective and
+is controlled by Pacemaker on the host.
+
+## Intended policy
+
+REQUEST:
+- Gate Let's Encrypt creation before database insertion.
+
+RENEW:
+- Gate automatic and manual renewal before Certbot execution.
+
+REVOKE:
+- Gate certificate deletion before the database row is marked deleted.
+- Gate Certbot revocation again as defense in depth.
+
+## Safety
+
+Requested mutations must fail closed.
+
+If an expected NPM source anchor cannot be identified or verification fails,
+the patcher must exit non-zero rather than start an ungated NPM backend.