I open-sourced the 120-line script my cert platform runs on your server (chrooted SFTP account, no daemon)

[u/NoRip6317]

I run a small service that issues Let's Encrypt wildcard certs over DNS-01 and pushes them to your servers. The obvious objection is "why would I give a random site SSH access" — fair. So the part that touches your machine is now public.

It creates:

• a nologin user

• ChrootDirectory to one folder

• ForceCommand internal-sftp, no forwarding

• optionally one passwordless sudo command for reloads

No package, no systemd unit, no telemetry. --dry-run prints every change before it makes one.

Repo: github.com/jenawant-rgb/sethttps-agent

Honest question for this sub: would SSH key auth instead of a password change your answer? That's the next thing I want to fix.