Initialize modular NPM ACME authority patcher

patch_acme.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+
+"""
+Nginx Proxy Manager ACME authority patch orchestrator.
+
+This module:
+  1. Reads ACME gate configuration from environment variables.
+  2. Loads NPM certificate.js.
+  3. Applies only the requested mutations.
+  4. Verifies every requested mutation.
+  5. Writes the resulting source only after all enabled gates succeed.
+
+Runtime ACME authority is NOT controlled here.
+Patched NPM code reads the Pacemaker-controlled authority token.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from functions import common
+from functions import request
+from functions import renew
+from functions import revoke
+
+
+DEFAULT_CERTIFICATE_JS = "/app/internal/certificate.js"
+
+
+def main() -> None:
+    certificate_js = Path(
+        os.environ.get(
+            "NPM_CERTIFICATE_JS",
+            DEFAULT_CERTIFICATE_JS,
+        )
+    )
+
+    config = common.load_config()
+
+    common.log(f"certificate.js={certificate_js}")
+    common.log(f"request_gate={config.request}")
+    common.log(f"renew_gate={config.renew}")
+    common.log(f"revoke_gate={config.revoke}")
+
+    source = common.load_source(certificate_js)
+
+    if config.any_enabled:
+        source = common.apply_authority_helper(source)
+
+    if config.request:
+        source = request.apply(source)
+
+    if config.renew:
+        source = renew.apply(source)
+
+    if config.revoke:
+        source = revoke.apply(source)
+
+    common.verify(source, config)
+    common.write_source(certificate_js, source)
+
+    common.log("All requested ACME authority gates applied successfully")
+
+
+if __name__ == "__main__":
+    main()