/**
 * Let's Encrypt TLS for nginx vhosts via certbot — issuance + automatic
 * renewal, mirroring Forge's SSL handling.
 *
 * `certbot --nginx` reads the site's :80 server block, obtains a certificate
 * for its `server_name`s, and rewrites the vhost to serve :443 + redirect
 * :80 → :443. The apt `certbot` package installs a `certbot.timer` that renews
 * twice daily; we add a deploy-hook so nginx reloads after a renewal.
 *
 * For the `custom` provider the vhost is rendered with the operator's cert
 * directly (see nginx-vhost's `ssl` option), so certbot is not involved.
 */
import type { SiteConfig, SslDnsConfig } from '@ts-cloud/core';
/** Resolve the effective SSL provider for a site (Let's Encrypt by default when it has a domain). */
export declare function resolveSslProvider(site: SiteConfig): 'letsencrypt' | 'custom' | 'none';
/** Path of the certbot credentials INI for a DNS provider. */
export declare function dnsCredentialsPath(provider: SslDnsConfig['provider']): string;
/** Install certbot (+ optional DNS plugin) and ensure the auto-renew timer is enabled. */
export declare function buildCertbotInstallScript(dns?: SslDnsConfig): string[];
export interface CertbotIssueOptions {
    /** Primary domain. */
    domain: string;
    /** Additional SANs (site aliases). */
    aliases?: string[];
    /** Contact email for registration / expiry notices. */
    email?: string;
    /** Redirect HTTP → HTTPS (Forge default). @default true */
    redirect?: boolean;
    /** Issue `*.<domain>` + `<domain>` (requires `dns`). */
    wildcard?: boolean;
    /** DNS-01 validation via a certbot DNS plugin (required for wildcard). */
    dns?: SslDnsConfig;
}
/**
 * Build the commands that write a DNS provider's certbot credentials INI
 * (root-only) so certbot can create the `_acme-challenge` records. Returns `[]`
 * when there are no credentials (e.g. route53 using instance-role creds).
 */
export declare function buildDnsCredentialsScript(dns: SslDnsConfig): string[];
/**
 * Issue (or expand) a Let's Encrypt cert. Uses the nginx (HTTP-01) plugin by
 * default; with `dns` set, uses DNS-01 via the provider plugin (the only way to
 * get a wildcard). Idempotent: `--keep-until-expiring` reuses a valid cert.
 */
export declare function buildCertbotIssueScript(options: CertbotIssueOptions): string[];
/**
 * Full SSL script for a site, dispatched on its provider. Returns `[]` for
 * `custom`/`none` (custom certs are baked into the vhost already). A wildcard
 * request without a DNS config is impossible (HTTP-01 can't do wildcards), so
 * it's skipped.
 */
export declare function buildSslScript(site: SiteConfig): string[];
