{
  name        = "acme_certd",
  version     = "0.1.0",
  description = "TLS certificate issuance and renewal via acme.sh with DNS-01 challenge. Runs as a systemd timer. No cert-manager dependency — suitable for bare VM fleets. DNS provider is pluggable; Cloudflare (dns_cf) is the reference implementation.",
  tags        = ["tls", "acme", "certificates", "dns-01", "systemd"],
  modes       = ["systemd_timer"],
  dependencies = [],
  provides    = [{ id = "tls-certificates", version = "0.1", interface = "acme-certd" }],
  requires    = [
    { capability = "vm-lifecycle",  kind = 'Required },
    { capability = "ssh-access",    kind = 'Required },
    { capability = "dns-api-token", kind = 'Required },
  ],
  conflicts_with = [],
  best_practices = ["dns-01-challenge", "wildcard-cert-per-fleet"],
}