v0.4.8

Added

• install.sh --acme-ca=staging orders certificates from Let's Encrypt's staging CA. Production allows 5 certificates per exact set of identifiers per 168h, and every test cycle that starts from an empty certificate store spends one: uninstall.sh --purge removes the traefik-acme volume, and the first install after enabling userns-remap moves Docker's data root to /var/lib/docker/<uid>.<gid>, orphaning the old volume just the same. Five reinstalls on one hostname exhaust the quota; Traefik then logs a 429 and serves its self-signed TRAEFIK DEFAULT CERT, which reaches the operator as an invalid-certificate warning on a host that otherwise installed cleanly. Staging certificates are untrusted, but the issuance path — DNS, :443, TLS-ALPN-01, the ACME store — is the same one, so a test install still proves it works. DEVGRAIL_ACME_CA is the env-var form; a directory URL is accepted for a private CA (pebble, an internal ACME server).

  Each CA keeps its own store file under the traefik-acme volume — acme.json for production, acme-staging.json for staging — because acme.json holds the registered ACME account and an account from one CA is unknown to another. That also means a staging test cannot overwrite production certificates that the rate limit would not let you re-issue, and switching back with --acme-ca=production picks them up again instead of re-ordering. An upgrade that names no CA keeps whichever one the prior install used, and the closing banner says plainly when certificates are coming from a non-production CA.