From 15010d062ae276a92065cd6ea7dc94b749e20756 Mon Sep 17 00:00:00 2001
From: Lexi Winter <ivy@FreeBSD.org>
Date: Wed, 4 Jun 2025 10:42:19 +0100
Subject: allow PREFIX to be customised

---
 .gitignore             |   3 +
 900.lfacme.sh          |  29 ------
 900.lfacme.sh.in       |  29 ++++++
 Makefile               | 106 +++++++++++--------
 README                 |   3 -
 acme.conf.5            |  50 ---------
 acme.conf.5.in         |  50 +++++++++
 acme.conf.sample       |  86 ----------------
 acme.conf.sample.in    |  86 ++++++++++++++++
 dns.sh                 |  78 --------------
 dns.sh.in              |  78 ++++++++++++++
 dnsutils.sh            |  84 ---------------
 dnsutils.sh.in         |  84 +++++++++++++++
 domains.conf.5         | 164 ------------------------------
 domains.conf.5.in      | 164 ++++++++++++++++++++++++++++++
 domains.conf.sample    |  33 ------
 domains.conf.sample.in |  33 ++++++
 example-hook.sh        |  27 -----
 example-hook.sh.in     |  27 +++++
 http.sh                |  51 ----------
 http.sh.in             |  51 ++++++++++
 init.sh                | 158 -----------------------------
 init.sh.in             | 158 +++++++++++++++++++++++++++++
 kerberos.sh            |  86 ----------------
 kerberos.sh.in         |  86 ++++++++++++++++
 lfacme-dns.7           |  61 -----------
 lfacme-dns.7.in        |  61 +++++++++++
 lfacme-http.7          |  57 -----------
 lfacme-http.7.in       |  57 +++++++++++
 lfacme-kerberos.7      |  75 --------------
 lfacme-kerberos.7.in   |  75 ++++++++++++++
 lfacme-renew.8         |  48 ---------
 lfacme-renew.8.in      |  48 +++++++++
 lfacme-renew.sh        | 269 -------------------------------------------------
 lfacme-renew.sh.in     | 269 +++++++++++++++++++++++++++++++++++++++++++++++++
 lfacme-setup.8         |  45 ---------
 lfacme-setup.8.in      |  45 +++++++++
 lfacme-setup.sh        |  34 -------
 lfacme-setup.sh.in     |  34 +++++++
 lfacme.7               |  76 --------------
 lfacme.7.in            |  76 ++++++++++++++
 41 files changed, 1579 insertions(+), 1555 deletions(-)
 delete mode 100644 900.lfacme.sh
 create mode 100644 900.lfacme.sh.in
 delete mode 100644 acme.conf.5
 create mode 100644 acme.conf.5.in
 delete mode 100644 acme.conf.sample
 create mode 100644 acme.conf.sample.in
 delete mode 100644 dns.sh
 create mode 100644 dns.sh.in
 delete mode 100644 dnsutils.sh
 create mode 100644 dnsutils.sh.in
 delete mode 100644 domains.conf.5
 create mode 100644 domains.conf.5.in
 delete mode 100644 domains.conf.sample
 create mode 100644 domains.conf.sample.in
 delete mode 100644 example-hook.sh
 create mode 100644 example-hook.sh.in
 delete mode 100644 http.sh
 create mode 100644 http.sh.in
 delete mode 100644 init.sh
 create mode 100644 init.sh.in
 delete mode 100644 kerberos.sh
 create mode 100644 kerberos.sh.in
 delete mode 100644 lfacme-dns.7
 create mode 100644 lfacme-dns.7.in
 delete mode 100644 lfacme-http.7
 create mode 100644 lfacme-http.7.in
 delete mode 100644 lfacme-kerberos.7
 create mode 100644 lfacme-kerberos.7.in
 delete mode 100644 lfacme-renew.8
 create mode 100644 lfacme-renew.8.in
 delete mode 100644 lfacme-renew.sh
 create mode 100644 lfacme-renew.sh.in
 delete mode 100644 lfacme-setup.8
 create mode 100644 lfacme-setup.8.in
 delete mode 100644 lfacme-setup.sh
 create mode 100644 lfacme-setup.sh.in
 delete mode 100644 lfacme.7
 create mode 100644 lfacme.7.in

diff --git a/.gitignore b/.gitignore
index 89c1dbe..5ddfa4c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,5 @@
 .*.sw?
 /dist
+*.[12345678]
+*.sh
+*.sample
diff --git a/900.lfacme.sh b/900.lfacme.sh
deleted file mode 100644
index dabb890..0000000
--- a/900.lfacme.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#! /bin/sh
-# This source code is released into the public domain.
-#
-# Run lfacme-renew to renew ACME certificates.
-
-if [ -r /etc/defaults/periodic.conf ]; then
-	. /etc/defaults/periodic.conf
-	source_periodic_confs
-fi
-
-PATH=$PATH:/usr/local/bin:/usr/local/sbin
-export PATH
-
-# Exit if lfacme isn't installed but the periodic script was left over
-# for some reason.
-if ! [ -x /usr/local/sbin/lfacme-renew ]; then
-	exit 0
-fi
-
-case "$daily_lfacme_enable" in
-[Yy][Ee][Ss])
-	printf 'Renewing ACME certificates with lfacme:\n'
-
-	/usr/local/sbin/lfacme-renew
-	;;
-
-*)
-	;;
-esac
diff --git a/900.lfacme.sh.in b/900.lfacme.sh.in
new file mode 100644
index 0000000..f1fae33
--- /dev/null
+++ b/900.lfacme.sh.in
@@ -0,0 +1,29 @@
+#! /bin/sh
+# This source code is released into the public domain.
+#
+# Run lfacme-renew to renew ACME certificates.
+
+if [ -r /etc/defaults/periodic.conf ]; then
+	. /etc/defaults/periodic.conf
+	source_periodic_confs
+fi
+
+PATH=$PATH:__PREFIX__/bin:__PREFIX__/sbin
+export PATH
+
+# Exit if lfacme isn't installed but the periodic script was left over
+# for some reason.
+if ! [ -x __BINDIR__/lfacme-renew ]; then
+	exit 0
+fi
+
+case "$daily_lfacme_enable" in
+[Yy][Ee][Ss])
+	printf 'Renewing ACME certificates with lfacme:\n'
+
+	__BINDIR__/lfacme-renew
+	;;
+
+*)
+	;;
+esac
diff --git a/Makefile b/Makefile
index 007b02c..13e4895 100644
--- a/Makefile
+++ b/Makefile
@@ -3,10 +3,11 @@
 PREFIX?=	/usr/local
 DESTDIR?=
 
-LIBDIR?=	${DESTDIR}${PREFIX}/share/lfacme
-BINDIR?=	${DESTDIR}${PREFIX}/sbin
-CONFDIR?=	${DESTDIR}${PREFIX}/etc
-MANDIR?=	${DESTDIR}${PREFIX}/share/man
+LIBDIR?=	${PREFIX}/share/lfacme
+BINDIR?=	${PREFIX}/sbin
+CONFDIR?=	${PREFIX}/etc
+MANDIR?=	${PREFIX}/share/man
+PERIODICDIR=	${PREFIX}/etc/periodic/daily
 MAN5DIR?=	${MANDIR}/man5
 MAN7DIR?=	${MANDIR}/man7
 MAN8DIR?=	${MANDIR}/man8
@@ -41,80 +42,103 @@ MAN7=		lfacme.7 \
 MAN8=		lfacme-renew.8 \
 		lfacme-setup.8
 
-PERIODICDIR=	/usr/local/etc/periodic/daily
 PERIODICMODE?=	0755
 PERIODIC=	900.lfacme.sh
 
+SED?=		sed
+REPLACE=	sed	-e 's,__PREFIX__,${PREFIX},g' \
+			-e 's,__CONFDIR__,${CONFDIR},g' \
+			-e 's,__LIBDIR__,${LIBDIR},g' \
+			-e 's,__BINDIR__,${BINDIR},g'
+
 default: all
 
-all:
-	@echo "Nothing to do."
+all: ${MAN5} ${MAN7} ${MAN8} ${LIB} ${BIN} ${CHALLENGE} ${HOOK} ${PERIODIC} ${CONF}
+
+clean:
+	rm -f ${MAN5} ${MAN7} ${MAN8} ${LIB} ${BIN}
+	rm -f ${HOOK} ${CHALLENGE} ${PERIODIC} ${CONF}
+
+%.sh: %.sh.in
+	${REPLACE} <$< >$@
+
+%.sample: %.sample.in
+	${REPLACE} <$< >$@
+
+%.5: %.5.in
+	${REPLACE} <$< >$@
+
+%.7: %.7.in
+	${REPLACE} <$< >$@
+
+%.8: %.8.in
+	${REPLACE} <$< >$@
 
 install: install-lib install-bin install-conf install-hook install-man install-periodic
 
-install-lib:
-	@echo 'create ${LIBDIR}'; install -d ${LIBDIR}
+install-lib: all
+	@echo 'create ${DESTDIR}${LIBDIR}'; install -d ${DESTDIR}${LIBDIR}
 	@for lib in ${LIB}; do \
-		echo "install ${LIBDIR}/$$lib"; \
-		install -C -m ${LIBMODE} "$$lib" "${LIBDIR}/$$lib"; \
+		echo "install ${DESTDIR}${LIBDIR}/$$lib"; \
+		install -C -m ${LIBMODE} "$$lib" "${DESTDIR}${LIBDIR}/$$lib"; \
 	done
-	@echo 'create ${LIBDIR}/challenge'; install -d ${LIBDIR}/challenge;
+	@echo 'create ${DESTDIR}${LIBDIR}/challenge'; install -d ${DESTDIR}${LIBDIR}/challenge;
 	@for challenge in ${CHALLENGE}; do \
 		basename=$${challenge%*.sh}; \
-		echo "install ${LIBDIR}/challenge/$$basename"; \
+		echo "install ${DESTDIR}${LIBDIR}/challenge/$$basename"; \
 		install -C -m ${CHALLENGEMODE} "$$challenge" \
-			"${LIBDIR}/challenge/$$basename"; \
+			"${DESTDIR}${LIBDIR}/challenge/$$basename"; \
 	done
 
-install-bin:
-	@echo 'create ${BINDIR}'; install -d ${BINDIR}
+install-bin: all
+	@echo 'create ${DESTDIR}${BINDIR}'; install -d ${DESTDIR}${BINDIR}
 	@for bin in ${BIN}; do \
 		basename=$${bin%*.sh}; \
-		echo "install ${BINDIR}/$$basename"; \
-		install -C -m ${BINMODE} "$$bin" "${BINDIR}/$$basename"; \
+		echo "install ${DESTDIR}${BINDIR}/$$basename"; \
+		install -C -m ${BINMODE} "$$bin" "${DESTDIR}${BINDIR}/$$basename"; \
 	done
 
-install-conf:
-	@echo 'create ${CONFDIR}'; install -d ${CONFDIR};
+install-conf: all
+	@echo 'create ${DESTDIR}${CONFDIR}'; install -d ${DESTDIR}${CONFDIR};
 	@for conf in ${CONF}; do \
-		echo "install ${CONFDIR}/$$conf"; \
-		install -C -m ${CONFMODE} "$$conf" "${CONFDIR}/$$conf"; \
+		echo "install ${DESTDIR}${CONFDIR}/$$conf"; \
+		install -C -m ${CONFMODE} "$$conf" "${DESTDIR}${CONFDIR}/$$conf"; \
 	done
 
-install-hook:
-	@echo 'create ${HOOKDIR}'; install -d ${HOOKDIR};
+install-hook: all
+	@echo 'create ${DESTDIR}${HOOKDIR}'; install -d ${DESTDIR}${HOOKDIR};
 	@for hook in ${HOOK}; do \
 		basename=$${hook%*.sh}; \
-		echo "install ${HOOKDIR}/$$basename"; \
-		install -C -m ${HOOKMODE} "$$hook" "${HOOKDIR}/$$basename"; \
+		echo "install ${DESTDIR}${HOOKDIR}/$$basename"; \
+		install -C -m ${HOOKMODE} "$$hook" "${DESTDIR}${HOOKDIR}/$$basename"; \
 	done
 
-install-man:
-	@echo 'create ${MANDIR}'; install -d ${MANDIR}
-	@echo 'create ${MAN5DIR}'; install -d ${MAN5DIR}
+install-man: all
+	@echo 'create ${DESTDIR}${MANDIR}'; install -d ${DESTDIR}${MANDIR}
+	@echo 'create ${DESTDIR}${MAN5DIR}'; install -d ${DESTDIR}${MAN5DIR}
 	@for man in ${MAN5}; do \
-		echo "install ${MAN5DIR}/$$man"; \
-		install -C -m ${MANMODE} "$$man" "${MAN5DIR}/$$man"; \
+		echo "install ${DESTDIR}${MAN5DIR}/$$man"; \
+		install -C -m ${MANMODE} "$$man" "${DESTDIR}${MAN5DIR}/$$man"; \
 	done
-	@echo 'create ${MAN7DIR}'; install -d ${MAN7DIR}
+	@echo 'create ${DESTDIR}${MAN7DIR}'; install -d ${DESTDIR}${MAN7DIR}
 	@for man in ${MAN7}; do \
-		echo "install ${MAN7DIR}/$$man"; \
-		install -C -m ${MANMODE} "$$man" "${MAN7DIR}/$$man"; \
+		echo "install ${DESTDIR}${MAN7DIR}/$$man"; \
+		install -C -m ${MANMODE} "$$man" "${DESTDIR}${MAN7DIR}/$$man"; \
 	done
-	@echo 'create ${MAN8DIR}'; install -d ${MAN8DIR}
+	@echo 'create ${DESTDIR}${MAN8DIR}'; install -d ${DESTDIR}${MAN8DIR}
 	@for man in ${MAN8}; do \
-		echo "install ${MAN8DIR}/$$man"; \
-		install -C -m ${MANMODE} "$$man" "${MAN8DIR}/$$man"; \
+		echo "install ${DESTDIR}${MAN8DIR}/$$man"; \
+		install -C -m ${MANMODE} "$$man" "${DESTDIR}${MAN8DIR}/$$man"; \
 	done
 
-install-periodic:
+install-periodic: all
 	@if [ $$(uname) = "FreeBSD" ]; then \
-		echo 'create ${PERIODICDIR}'; install -d ${PERIODICDIR}; \
+		echo 'create ${DESTDIR}${PERIODICDIR}'; install -d ${DESTDIR}${PERIODICDIR}; \
 		for periodic in ${PERIODIC}; do \
 			basename=$${periodic%*.sh}; \
-			echo "install ${PERIODICDIR}/$$basename"; \
+			echo "install ${DESTDIR}${PERIODICDIR}/$$basename"; \
 			install -C -m ${PERIODICMODE} "$$periodic" \
-				"${PERIODICDIR}/$$basename"; \
+				"${DESTDIR}${PERIODICDIR}/$$basename"; \
 		done; \
 	fi
 
diff --git a/README b/README
index 328d5d3..8a57484 100644
--- a/README
+++ b/README
@@ -60,9 +60,6 @@ usage
 known issues
 ------------
 
-+ lfacme assumes it's installed in /usr/local.  if you want to change this,
-  you'll need to edit the scripts.
-
 + we disable ARI in uacme (uacme --no-ari) because it's broken on non-glibc
   platforms.  this is a uacme bug: https://github.com/ndilieto/uacme/issues/91.
   the only impact of this is that certificates will be renewed 30 days before
diff --git a/acme.conf.5 b/acme.conf.5
deleted file mode 100644
index f1f2638..0000000
--- a/acme.conf.5
+++ /dev/null
@@ -1,50 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 3, 2025
-.Dt ACME.CONF 5
-.Os
-.Sh NAME
-.Nm acme.conf
-.Nd lfacme global configuration file
-.Sh SYNOPSIS
-.Pa /usr/local/etc/lfacme/acme.conf
-.Sh DESCRIPTION
-The
-.Nm
-file is used to configure the global behaviour of
-.Nm lfacme .
-Each option should be configured as a
-.Xr sh 1
-variable assignment, i.e.
-.Dq Ar option Ns = Ns Ar value .
-.Pp
-Alternatively, options may be set as environment variables prior to running
-.Nm lfacme
-utilities.
-If all required options are set in the environment, then creating the
-.Nm
-file is not required.
-.Pp
-The following configuration variables are supported:
-.Bl -tag -width indent
-.It Va ACME_URL
-(Required.)
-The URL of the ACME server.
-.It Va ACME_DATADIR
-The path to the runtime data directory, where the ACME account key and any
-issued certificates will be stored.
-The default value is
-.Pa /var/db/lfacme .
-.It Va ACME_HOOKDIR
-The path to a directory containing hooks to invoke when issuing certificates
-(see
-.Xr domains.conf 5 ) .
-The default value is
-.Pa /usr/local/etc/lfacme/hooks .
-.El
-.Pp
-Additional configuration variables may be used by the ACME validation hooks;
-refer to the manual page for each hook for more details.
-.Sh SEE ALSO
-.Xr domains.conf 5 ,
-.Xr lfacme-renew 8 ,
-.Xr lfacme-setup 8
diff --git a/acme.conf.5.in b/acme.conf.5.in
new file mode 100644
index 0000000..2210cad
--- /dev/null
+++ b/acme.conf.5.in
@@ -0,0 +1,50 @@
+.\" This source code is released into the public domain.
+.Dd June 3, 2025
+.Dt ACME.CONF 5
+.Os
+.Sh NAME
+.Nm acme.conf
+.Nd lfacme global configuration file
+.Sh SYNOPSIS
+.Pa __CONFDIR__/acme.conf
+.Sh DESCRIPTION
+The
+.Nm
+file is used to configure the global behaviour of
+.Nm lfacme .
+Each option should be configured as a
+.Xr sh 1
+variable assignment, i.e.
+.Dq Ar option Ns = Ns Ar value .
+.Pp
+Alternatively, options may be set as environment variables prior to running
+.Nm lfacme
+utilities.
+If all required options are set in the environment, then creating the
+.Nm
+file is not required.
+.Pp
+The following configuration variables are supported:
+.Bl -tag -width indent
+.It Va ACME_URL
+(Required.)
+The URL of the ACME server.
+.It Va ACME_DATADIR
+The path to the runtime data directory, where the ACME account key and any
+issued certificates will be stored.
+The default value is
+.Pa /var/db/lfacme .
+.It Va ACME_HOOKDIR
+The path to a directory containing hooks to invoke when issuing certificates
+(see
+.Xr domains.conf 5 ) .
+The default value is
+.Pa __CONFDIR__/hooks .
+.El
+.Pp
+Additional configuration variables may be used by the ACME validation hooks;
+refer to the manual page for each hook for more details.
+.Sh SEE ALSO
+.Xr domains.conf 5 ,
+.Xr lfacme-renew 8 ,
+.Xr lfacme-setup 8
diff --git a/acme.conf.sample b/acme.conf.sample
deleted file mode 100644
index f1d0906..0000000
--- a/acme.conf.sample
+++ /dev/null
@@ -1,86 +0,0 @@
-# This is a sample configuration file for lfacme.  It is a shell script,
-# so you can include other files or call programs here if you like.
-#
-# See acme.conf(5) for documentation on this file.
-
-#######################################################################
-# Base options.
-#
-# These options are used by lfacme itself.
-
-
-### ACME_URL
-# The URL of the ACME server.
-# No default, you must set this.
-
-# Let's Encrypt production:
-#ACME_URL="https://acme-v02.api.letsencrypt.org/directory"
-
-# Let's Encrypt staging:
-#ACME_URL="https://acme-staging-v02.api.letsencrypt.org/directory"
-
-
-### ACME_DATADIR
-# Runtime data directory.
-# This is where the ACME account key and the issued certificates are stored.
-# The default is /var/db/lfacme.
-
-#ACME_DATADIR="/var/db/lfacme"
-
-
-### ACME_HOOKDIR
-# The path to the directory containing certificate hooks.
-# The default is "/usr/local/etc/lfacme/hooks".
-# There is usually no need to change this.
-
-#ACME_HOOKDIR="/some/directory"
-
-
-#######################################################################
-# lfacme-http(5) options.
-#
-# These options are used for the "http" challenge.
-
-
-### ACME_HTTP_CHALLENGE_DIR
-# When using the "http" challenge handler, this is the directory which contains
-# ACME challenges.  This must be served at /.well-known/acme-challenge on any
-# domain using http validation.
-# No default, you must set this if you use the "http" handler.
-
-#ACME_HTTP_CHALLENGE_DIR="/var/www/acme-challenge"
-
-
-#######################################################################
-# lfacme-dns(5) options.
-#
-# These options are used for the "dns" challenge.
-
-
-### ACME_DNS_KEYFILE
-# Path to the TSIG key nsupdate will use to authenticate the update.
-# No default; you must configure this when using the dns challenge.
-
-#ACME_DNS_KEYFILE="/path/to/key"
-
-
-#######################################################################
-# lfacme-kerberos(5) options.
-#
-# These options are used for the "kerberos" challenge.
-
-
-### ACME_KERBEROS_PRINCIPAL
-# When using the "kerberos" challenge handler, this is the Kerberos principal
-# we use for nsupdate.  The default is "host/$(hostname)", which assumes a
-# default realm is configured in /etc/krb5.conf.
-
-#ACME_KERBEROS_PRINCIPAL="host/server.example.org@EXAMPLE.ORG"
-
-
-### ACME_KERBEROS_KEYTAB
-# When using the "kerberos" challenge handler, this is the keytab used to
-# issue the ticket.  It must contain a key for $ACME_KERBEROS_PRINCIPAL.
-# The default is /etc/krb5.keytab.
-
-#ACME_KERBEROS_KEYTAB="/etc/krb5.keytab"
diff --git a/acme.conf.sample.in b/acme.conf.sample.in
new file mode 100644
index 0000000..d6cea21
--- /dev/null
+++ b/acme.conf.sample.in
@@ -0,0 +1,86 @@
+# This is a sample configuration file for lfacme.  It is a shell script,
+# so you can include other files or call programs here if you like.
+#
+# See acme.conf(5) for documentation on this file.
+
+#######################################################################
+# Base options.
+#
+# These options are used by lfacme itself.
+
+
+### ACME_URL
+# The URL of the ACME server.
+# No default, you must set this.
+
+# Let's Encrypt production:
+#ACME_URL="https://acme-v02.api.letsencrypt.org/directory"
+
+# Let's Encrypt staging:
+#ACME_URL="https://acme-staging-v02.api.letsencrypt.org/directory"
+
+
+### ACME_DATADIR
+# Runtime data directory.
+# This is where the ACME account key and the issued certificates are stored.
+# The default is /var/db/lfacme.
+
+#ACME_DATADIR="/var/db/lfacme"
+
+
+### ACME_HOOKDIR
+# The path to the directory containing certificate hooks.
+# The default is "__CONFDIR__/hooks".
+# There is usually no need to change this.
+
+#ACME_HOOKDIR="/some/directory"
+
+
+#######################################################################
+# lfacme-http(5) options.
+#
+# These options are used for the "http" challenge.
+
+
+### ACME_HTTP_CHALLENGE_DIR
+# When using the "http" challenge handler, this is the directory which contains
+# ACME challenges.  This must be served at /.well-known/acme-challenge on any
+# domain using http validation.
+# No default, you must set this if you use the "http" handler.
+
+#ACME_HTTP_CHALLENGE_DIR="/var/www/acme-challenge"
+
+
+#######################################################################
+# lfacme-dns(5) options.
+#
+# These options are used for the "dns" challenge.
+
+
+### ACME_DNS_KEYFILE
+# Path to the TSIG key nsupdate will use to authenticate the update.
+# No default; you must configure this when using the dns challenge.
+
+#ACME_DNS_KEYFILE="/path/to/key"
+
+
+#######################################################################
+# lfacme-kerberos(5) options.
+#
+# These options are used for the "kerberos" challenge.
+
+
+### ACME_KERBEROS_PRINCIPAL
+# When using the "kerberos" challenge handler, this is the Kerberos principal
+# we use for nsupdate.  The default is "host/$(hostname)", which assumes a
+# default realm is configured in /etc/krb5.conf.
+
+#ACME_KERBEROS_PRINCIPAL="host/server.example.org@EXAMPLE.ORG"
+
+
+### ACME_KERBEROS_KEYTAB
+# When using the "kerberos" challenge handler, this is the keytab used to
+# issue the ticket.  It must contain a key for $ACME_KERBEROS_PRINCIPAL.
+# The default is /etc/krb5.keytab.
+
+#ACME_KERBEROS_KEYTAB="/etc/krb5.keytab"
diff --git a/dns.sh b/dns.sh
deleted file mode 100644
index 9b26bd3..0000000
--- a/dns.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#! /bin/sh
-# This source code is released into the public domain.
-
-. /usr/local/share/lfacme/init.sh
-. /usr/local/share/lfacme/dnsutils.sh
-
-# begin, done or failed
-ACTION=$1
-# ACME method, must be dns-01.
-METHOD=$2
-# This is the full domain name we're authorising.
-DOMAIN=$3
-# Token name, not used for dns-01.
-TOKEN=$4
-# The token value we need to create.
-AUTH=$5
-
-if [ "$#" -ne 5 ]; then
-	_fatal "missing arguments"
-fi
-
-if [ "$METHOD" != "dns-01" ]; then
-	exit 1
-fi
-
-if [ -z "$ACME_DNS_KEYFILE" ]; then
-	_fatal "ACME_DNS_KEYFILE not configured"
-fi
-
-# Add a new record using nsupdate.
-_add_record() {
-	local domain="$1"
-	local auth="$2"
-
-	nsupdate -k "$ACME_DNS_KEYFILE" <<EOF
-update add _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
-send
-EOF
-	return $?
-}
-
-# Remove an existing record using nsupdate.
-_remove_record() {
-	local domain="$1"
-	local auth="$2"
-
-	nsupdate -k "$ACME_DNS_KEYFILE" <<EOF
-update delete _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
-send
-EOF
-	return $?
-}
-
-case "$ACTION" in
-	begin)
-		if ! _add_record "$DOMAIN" "$AUTH"; then
-			_fatal "failed to add the DNS record for %s" "$DOMAIN"
-			exit 1
-		fi
-
-		if ! lfacme_dns_wait_for_record "$DOMAIN" "$AUTH"; then
-			_fatal "timed out waiting for the DNS record for '%s' to be published" \
-				"$DOMAIN"
-			exit 1
-		fi
-
-		exit 0
-		;;
-
-	done|failed)
-		_remove_record "$DOMAIN" "$AUTH"
-		exit $?
-		;;
-
-	*)
-		_fatal "unknown action: %s" "$ACTION"
-		;;
-esac
diff --git a/dns.sh.in b/dns.sh.in
new file mode 100644
index 0000000..67fb280
--- /dev/null
+++ b/dns.sh.in
@@ -0,0 +1,78 @@
+#! /bin/sh
+# This source code is released into the public domain.
+
+. __LIBDIR__/init.sh
+. __LIBDIR__/dnsutils.sh
+
+# begin, done or failed
+ACTION=$1
+# ACME method, must be dns-01.
+METHOD=$2
+# This is the full domain name we're authorising.
+DOMAIN=$3
+# Token name, not used for dns-01.
+TOKEN=$4
+# The token value we need to create.
+AUTH=$5
+
+if [ "$#" -ne 5 ]; then
+	_fatal "missing arguments"
+fi
+
+if [ "$METHOD" != "dns-01" ]; then
+	exit 1
+fi
+
+if [ -z "$ACME_DNS_KEYFILE" ]; then
+	_fatal "ACME_DNS_KEYFILE not configured"
+fi
+
+# Add a new record using nsupdate.
+_add_record() {
+	local domain="$1"
+	local auth="$2"
+
+	nsupdate -k "$ACME_DNS_KEYFILE" <<EOF
+update add _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
+send
+EOF
+	return $?
+}
+
+# Remove an existing record using nsupdate.
+_remove_record() {
+	local domain="$1"
+	local auth="$2"
+
+	nsupdate -k "$ACME_DNS_KEYFILE" <<EOF
+update delete _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
+send
+EOF
+	return $?
+}
+
+case "$ACTION" in
+	begin)
+		if ! _add_record "$DOMAIN" "$AUTH"; then
+			_fatal "failed to add the DNS record for %s" "$DOMAIN"
+			exit 1
+		fi
+
+		if ! lfacme_dns_wait_for_record "$DOMAIN" "$AUTH"; then
+			_fatal "timed out waiting for the DNS record for '%s' to be published" \
+				"$DOMAIN"
+			exit 1
+		fi
+
+		exit 0
+		;;
+
+	done|failed)
+		_remove_record "$DOMAIN" "$AUTH"
+		exit $?
+		;;
+
+	*)
+		_fatal "unknown action: %s" "$ACTION"
+		;;
+esac
diff --git a/dnsutils.sh b/dnsutils.sh
deleted file mode 100644
index a1523ff..0000000
--- a/dnsutils.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-# This source code is released into the public domain.
-#
-# Utility functions for DNS-based authorizations.
-
-# Retrieve the nameservers for a given domain.  On failure, prints an error
-# message and exits.
-lfacme_dns_getnameservers() {
-	local domain="$1"
-
-	# Keep removing labels from the name until we find one with nameservers.
-	local _trydomain="$domain"
-	while ! [ -z "$_trydomain" ]; do
-		if [ "$_trydomain" = "${_trydomain#*.}" ]; then
-			# If there are no dots in the domain, we couldn't
-			# find the nameservers.
-			break
-		fi
-
-		# For CNAME records, a query for NS will return the CNAME.
-		# Therefore we have to check we actually got NS records.
-		local nameservers="$(
-			dig "$_trydomain" ns +noall +answer | \
-			awk '$4 == "NS" { print $5 }'
-		)"
-
-		if ! [ -z "$nameservers" ]; then
-			echo "$nameservers"
-			return
-		fi
-
-		_trydomain="${_trydomain#*.}"
-	done
-
-	_fatal "unable to find nameservers for %s" "$_trydomain"
-}
-
-# Wait for the DNS record to appear on a specific nameserver.
-lfacme_dns_wait_for_nameserver() {
-	local domain="$1"
-	local auth="$2"
-	local nameserver="$3"
-
-	_verbose "waiting for nameserver %s" "$nameserver"
-
-	local waited=0
-	local waitlimit=60
-	while sleep 1; do
-		waited=$((waited + 1))
-		if [ "$waited" -ge "$waitlimit" ]; then
-			_error "timed out waiting for '%s' on '%s'" \
-				"$domain" "$nameserver"
-			return 1
-		fi
-
-		local _rdatas="$(
-			dig "_acme-challenge.$domain" txt @$nameserver \
-				+noall +answer \
-			| awk '$4 == "TXT" { print $5 }'
-		)"
-		for rdata in $_rdatas; do
-			if [ "$rdata" = "\"$auth\"" ]; then
-				return 0
-			fi
-		done
-	done
-}
-
-# Wait for DNS servers to have the given record.
-lfacme_dns_wait_for_record() {
-	local domain="$1"
-	local auth="$2"
-	local nameservers="$(lfacme_dns_getnameservers "$domain")"
-
-	_verbose "waiting for the DNS record '%s' to be published" "$domain"
-	for ns in $nameservers; do
-		if ! lfacme_dns_wait_for_nameserver "$domain" "$auth" "$ns"; then
-			return 1
-		fi
-	done
-
-	return 0
-}
-
-
diff --git a/dnsutils.sh.in b/dnsutils.sh.in
new file mode 100644
index 0000000..a1523ff
--- /dev/null
+++ b/dnsutils.sh.in
@@ -0,0 +1,84 @@
+# This source code is released into the public domain.
+#
+# Utility functions for DNS-based authorizations.
+
+# Retrieve the nameservers for a given domain.  On failure, prints an error
+# message and exits.
+lfacme_dns_getnameservers() {
+	local domain="$1"
+
+	# Keep removing labels from the name until we find one with nameservers.
+	local _trydomain="$domain"
+	while ! [ -z "$_trydomain" ]; do
+		if [ "$_trydomain" = "${_trydomain#*.}" ]; then
+			# If there are no dots in the domain, we couldn't
+			# find the nameservers.
+			break
+		fi
+
+		# For CNAME records, a query for NS will return the CNAME.
+		# Therefore we have to check we actually got NS records.
+		local nameservers="$(
+			dig "$_trydomain" ns +noall +answer | \
+			awk '$4 == "NS" { print $5 }'
+		)"
+
+		if ! [ -z "$nameservers" ]; then
+			echo "$nameservers"
+			return
+		fi
+
+		_trydomain="${_trydomain#*.}"
+	done
+
+	_fatal "unable to find nameservers for %s" "$_trydomain"
+}
+
+# Wait for the DNS record to appear on a specific nameserver.
+lfacme_dns_wait_for_nameserver() {
+	local domain="$1"
+	local auth="$2"
+	local nameserver="$3"
+
+	_verbose "waiting for nameserver %s" "$nameserver"
+
+	local waited=0
+	local waitlimit=60
+	while sleep 1; do
+		waited=$((waited + 1))
+		if [ "$waited" -ge "$waitlimit" ]; then
+			_error "timed out waiting for '%s' on '%s'" \
+				"$domain" "$nameserver"
+			return 1
+		fi
+
+		local _rdatas="$(
+			dig "_acme-challenge.$domain" txt @$nameserver \
+				+noall +answer \
+			| awk '$4 == "TXT" { print $5 }'
+		)"
+		for rdata in $_rdatas; do
+			if [ "$rdata" = "\"$auth\"" ]; then
+				return 0
+			fi
+		done
+	done
+}
+
+# Wait for DNS servers to have the given record.
+lfacme_dns_wait_for_record() {
+	local domain="$1"
+	local auth="$2"
+	local nameservers="$(lfacme_dns_getnameservers "$domain")"
+
+	_verbose "waiting for the DNS record '%s' to be published" "$domain"
+	for ns in $nameservers; do
+		if ! lfacme_dns_wait_for_nameserver "$domain" "$auth" "$ns"; then
+			return 1
+		fi
+	done
+
+	return 0
+}
+
+
diff --git a/domains.conf.5 b/domains.conf.5
deleted file mode 100644
index fd071e4..0000000
--- a/domains.conf.5
+++ /dev/null
@@ -1,164 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 3, 2025
-.Dt DOMAINS.CONF 5
-.Os
-.Sh NAME
-.Nm domains.conf
-.Nd lfacme domains configuration file
-.Sh SYNOPSIS
-.Pa /usr/local/etc/lfacme/domains.conf
-.Sh DESCRIPTION
-The
-.Nm
-file is used to configure the certificates that
-.Nm lfacme
-will issue or renew.
-Each line specifies one certificate as a series of whitespace-separated fields.
-The first field is the certificate name, which is used by
-.Nm lfacme
-to create the certificate filename but is not part of the certificate itself.
-The remaining fields are either certificate options or subject alt names for
-the certificate.
-.Pp
-If no subject alt names are provided, then the certificate name is used as
-the common name and subject alt name.
-Otherwise, the first subject alt name is used as the common name.
-.Pp
-If the certificate name is
-.Dq * ,
-then this line will not cause a certificate to be issued;
-instead, any options set on this line will apply to all following lines,
-or until another line with the certificate name
-.Dq * ,
-which will replace the previously set options.
-.Pp
-The following options may be set:
-.Bl -tag -width indent
-.It Sy type Ns Li = Ns Ar keytype
-Configure the private key type.
-The
-.Ar keytype
-argument may be
-.Dq ec
-to generate a secp384r1 ECDSA key, or
-.Dq rsa
-to generate a 3072-bit RSA key.
-If not specified, the default value is
-.Dq ec .
-.It Sy challenge Ns Li = Ns Ar filename
-Invoke
-.Ar filename
-to handle ACME challenges for this certificate.
-If
-.Ar filename
-begins with a
-.Sq /
-character, then it is assumed to be an absolute path,
-otherwise it will be searched for in
-.Pa /usr/local/share/lfacme/challenge
-and
-.Pa /usr/local/etc/lfacme/challenge .
-.Pp
-The challenge script is passed to
-.Xr uacme 1 ;
-see the uacme documentation for details on the calling convention.
-.Pp
-The following challenge scripts are provided with
-.Nm lfacme :
-.Bl -tag -width kerberos
-.It Sy http
-Use HTTP-based validation.
-See
-.Xr lfacme-http 5 .
-This is the default challenge handler.
-.It Sy dns
-Use DNS-based validation with
-.Xr nsupdate 1 .
-See
-.Xr lfacme-dns 5 .
-.It Sy kerberos
-Use DNS-based validation with
-.Xr nsupdate 1
-using Kerberos authentication.
-See
-.Xr lfacme-kerberos 5 .
-.El
-.It Sy hook Ns Li = Ns Ar filename
-Invoke
-.Ar filename
-when this certificate is issued or renewed.
-If
-.Ar filename
-begins with a
-.Sq /
-character, then it is assumed to be an absolute path,
-otherwise it is relative to the
-.Va ACME_HOOKDIR
-configured in
-.Xr acme.conf 5 .
-This option may be specified multiple times.
-.Pp
-The hook will be called with a single argument,
-which may be one of the following:
-.Bl -tag -width newcert
-.It Sy newcert
-A certificate has been issued or renewed.
-.El
-.Pp
-The following environment variables will be set when running the hook script:
-.Bl -tag -width LFACME_CERTFILE
-.It Sy LFACME_CONFDIR
-The
-.Nm lfacme
-configuration directory, e.g.
-.Pa /usr/local/etc/lfacme .
-.It Sy LFACME_CERT
-The identifier of the certificate, i.e. the first field in
-.Nm .
-This is not necessarily the certificate's common name.
-.It Sy LFACME_CERTFILE
-The path of a file which contains the public certificate and any issuer
-certificates, in PEM format.
-.It Sy LFACME_KEYFILE
-The path of a file which contains the private key file in PEM format.
-.El
-.El
-.Sh EXAMPLES
-Set the key type to
-.Dq rsa
-for all certificates.
-.Bd -literal -offset indent
-*	type=rsa
-.Ed
-.Pp
-Issue a certificate for
-.Dq example.org
-using the default options.
-We don't provide any SANs, so the certificate name is used as the domain.
-.Bd -literal -offset indent
-example.org
-.Ed
-.Pp
-Issue a certificate for
-.Dq example.org
-with some SANs.
-Notice that because we specify one SAN, we now have to specify all of them.
-.Bd -literal -offset indent
-example.org	example.org www.example.org
-.Ed
-.Pp
-Issue two certificates for an SMTP server, one EC and one RSA.
-Some older SMTP clients still don't like EC certs.
-Run a hook after the certificate is (re)issued.
-.Bd -literal -offset indent
-smtp-ec		smtp.example.org	type=ec  hook=install-smtp-cert
-smtp-rsa	smtp.example.org	type=rsa hook=install-smtp-cert
-.Ed
-.Pp
-Issue a certificate for a server and run multiple hooks.
-.Bd -literal -offset indent
-server.example.org	hook=nginx hook=postfix hook=node-exporter
-.Ed
-.Sh SEE ALSO
-.Xr acme.conf 5 ,
-.Xr lfacme-renew 8
diff --git a/domains.conf.5.in b/domains.conf.5.in
new file mode 100644
index 0000000..4ac27db
--- /dev/null
+++ b/domains.conf.5.in
@@ -0,0 +1,164 @@
+.\" This source code is released into the public domain.
+.Dd June 3, 2025
+.Dt DOMAINS.CONF 5
+.Os
+.Sh NAME
+.Nm domains.conf
+.Nd lfacme domains configuration file
+.Sh SYNOPSIS
+.Pa __CONFDIR__/domains.conf
+.Sh DESCRIPTION
+The
+.Nm
+file is used to configure the certificates that
+.Nm lfacme
+will issue or renew.
+Each line specifies one certificate as a series of whitespace-separated fields.
+The first field is the certificate name, which is used by
+.Nm lfacme
+to create the certificate filename but is not part of the certificate itself.
+The remaining fields are either certificate options or subject alt names for
+the certificate.
+.Pp
+If no subject alt names are provided, then the certificate name is used as
+the common name and subject alt name.
+Otherwise, the first subject alt name is used as the common name.
+.Pp
+If the certificate name is
+.Dq * ,
+then this line will not cause a certificate to be issued;
+instead, any options set on this line will apply to all following lines,
+or until another line with the certificate name
+.Dq * ,
+which will replace the previously set options.
+.Pp
+The following options may be set:
+.Bl -tag -width indent
+.It Sy type Ns Li = Ns Ar keytype
+Configure the private key type.
+The
+.Ar keytype
+argument may be
+.Dq ec
+to generate a secp384r1 ECDSA key, or
+.Dq rsa
+to generate a 3072-bit RSA key.
+If not specified, the default value is
+.Dq ec .
+.It Sy challenge Ns Li = Ns Ar filename
+Invoke
+.Ar filename
+to handle ACME challenges for this certificate.
+If
+.Ar filename
+begins with a
+.Sq /
+character, then it is assumed to be an absolute path,
+otherwise it will be searched for in
+.Pa __LIBDIR__/challenge
+and
+.Pa __CONFDIR__/challenge .
+.Pp
+The challenge script is passed to
+.Xr uacme 1 ;
+see the uacme documentation for details on the calling convention.
+.Pp
+The following challenge scripts are provided with
+.Nm lfacme :
+.Bl -tag -width kerberos
+.It Sy http
+Use HTTP-based validation.
+See
+.Xr lfacme-http 5 .
+This is the default challenge handler.
+.It Sy dns
+Use DNS-based validation with
+.Xr nsupdate 1 .
+See
+.Xr lfacme-dns 5 .
+.It Sy kerberos
+Use DNS-based validation with
+.Xr nsupdate 1
+using Kerberos authentication.
+See
+.Xr lfacme-kerberos 5 .
+.El
+.It Sy hook Ns Li = Ns Ar filename
+Invoke
+.Ar filename
+when this certificate is issued or renewed.
+If
+.Ar filename
+begins with a
+.Sq /
+character, then it is assumed to be an absolute path,
+otherwise it is relative to the
+.Va ACME_HOOKDIR
+configured in
+.Xr acme.conf 5 .
+This option may be specified multiple times.
+.Pp
+The hook will be called with a single argument,
+which may be one of the following:
+.Bl -tag -width newcert
+.It Sy newcert
+A certificate has been issued or renewed.
+.El
+.Pp
+The following environment variables will be set when running the hook script:
+.Bl -tag -width LFACME_CERTFILE
+.It Sy LFACME_CONFDIR
+The
+.Nm lfacme
+configuration directory, e.g.
+.Pa __CONFDIR__ .
+.It Sy LFACME_CERT
+The identifier of the certificate, i.e. the first field in
+.Nm .
+This is not necessarily the certificate's common name.
+.It Sy LFACME_CERTFILE
+The path of a file which contains the public certificate and any issuer
+certificates, in PEM format.
+.It Sy LFACME_KEYFILE
+The path of a file which contains the private key file in PEM format.
+.El
+.El
+.Sh EXAMPLES
+Set the key type to
+.Dq rsa
+for all certificates.
+.Bd -literal -offset indent
+*	type=rsa
+.Ed
+.Pp
+Issue a certificate for
+.Dq example.org
+using the default options.
+We don't provide any SANs, so the certificate name is used as the domain.
+.Bd -literal -offset indent
+example.org
+.Ed
+.Pp
+Issue a certificate for
+.Dq example.org
+with some SANs.
+Notice that because we specify one SAN, we now have to specify all of them.
+.Bd -literal -offset indent
+example.org	example.org www.example.org
+.Ed
+.Pp
+Issue two certificates for an SMTP server, one EC and one RSA.
+Some older SMTP clients still don't like EC certs.
+Run a hook after the certificate is (re)issued.
+.Bd -literal -offset indent
+smtp-ec		smtp.example.org	type=ec  hook=install-smtp-cert
+smtp-rsa	smtp.example.org	type=rsa hook=install-smtp-cert
+.Ed
+.Pp
+Issue a certificate for a server and run multiple hooks.
+.Bd -literal -offset indent
+server.example.org	hook=nginx hook=postfix hook=node-exporter
+.Ed
+.Sh SEE ALSO
+.Xr acme.conf 5 ,
+.Xr lfacme-renew 8
diff --git a/domains.conf.sample b/domains.conf.sample
deleted file mode 100644
index 59ce539..0000000
--- a/domains.conf.sample
+++ /dev/null
@@ -1,33 +0,0 @@
-##
-# Domains configuration file for lfacme.
-#
-# This is NOT a shell script (unlike acme.conf) so you cannot use shell
-# syntax here.
-#
-# Empty lines and lines beginning with a '#' character are ignored.
-#
-# A few examples are provided here; see acme.conf(5) for complete documentation.
-
-
-# To use RSA (instead of the default ECDSA) for all certificates:
-*		type=rsa
-
-# To use HTTP for all challenges:
-*		challenge=http
-
-# Issue a cert for example.org using the default options.
-# We don't provide any SANs, so the certificate name is used as the domain.
-example.org
-
-# Issue a cert for example.org with some SANs.
-# Notice that because we specify one SAN, we now have to specify all of them.
-example.org	example.org www.example.org
-
-# Issue two certs for an SMTP server, one EC and one RSA.
-# Some older SMTP clients still don't like EC certs.
-# Run a hook after the certificate is (re)issued.
-smtp-ec		smtp.example.org	type=ec  hook=install-smtp-cert
-smtp-rsa	smtp.example.org	type=rsa hook=install-smtp-cert
-
-# Issue a certificate for a server and run multiple hooks.
-server.example.org	hook=nginx hook=postfix hook=node-exporter
diff --git a/domains.conf.sample.in b/domains.conf.sample.in
new file mode 100644
index 0000000..59ce539
--- /dev/null
+++ b/domains.conf.sample.in
@@ -0,0 +1,33 @@
+##
+# Domains configuration file for lfacme.
+#
+# This is NOT a shell script (unlike acme.conf) so you cannot use shell
+# syntax here.
+#
+# Empty lines and lines beginning with a '#' character are ignored.
+#
+# A few examples are provided here; see acme.conf(5) for complete documentation.
+
+
+# To use RSA (instead of the default ECDSA) for all certificates:
+*		type=rsa
+
+# To use HTTP for all challenges:
+*		challenge=http
+
+# Issue a cert for example.org using the default options.
+# We don't provide any SANs, so the certificate name is used as the domain.
+example.org
+
+# Issue a cert for example.org with some SANs.
+# Notice that because we specify one SAN, we now have to specify all of them.
+example.org	example.org www.example.org
+
+# Issue two certs for an SMTP server, one EC and one RSA.
+# Some older SMTP clients still don't like EC certs.
+# Run a hook after the certificate is (re)issued.
+smtp-ec		smtp.example.org	type=ec  hook=install-smtp-cert
+smtp-rsa	smtp.example.org	type=rsa hook=install-smtp-cert
+
+# Issue a certificate for a server and run multiple hooks.
+server.example.org	hook=nginx hook=postfix hook=node-exporter
diff --git a/example-hook.sh b/example-hook.sh
deleted file mode 100644
index 48eb07b..0000000
--- a/example-hook.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#! /bin/sh
-# This source code is released into the public domain.
-#
-# An example hook.
-
-# Action is always 'newcert', at least for now.
-action="$1"
-
-# Environment variables:
-# $LFACME_CERT is the name of the certificate
-# $LFACME_CERTFILE is the filename of the certificate.
-# $LFACME_KEYFILE is the filename of the private key.
-
-set -e
-
-case "$action" in
-newcert)
-	# The certificate was issued or renewed.
-	cp "$LFACME_CERTFILE" /usr/local/etc/nginx/tls/cert.pem
-	cp "$LFACME_KEYFILE" /usr/local/etc/nginx/tls/key.pem
-	nginx -s reload
-	;;
-
-*)
-	# Ignore unknown actions, because new ones might be added later.
-	;;
-esac
diff --git a/example-hook.sh.in b/example-hook.sh.in
new file mode 100644
index 0000000..64e0252
--- /dev/null
+++ b/example-hook.sh.in
@@ -0,0 +1,27 @@
+#! /bin/sh
+# This source code is released into the public domain.
+#
+# An example hook.
+
+# Action is always 'newcert', at least for now.
+action="$1"
+
+# Environment variables:
+# $LFACME_CERT is the name of the certificate
+# $LFACME_CERTFILE is the filename of the certificate.
+# $LFACME_KEYFILE is the filename of the private key.
+
+set -e
+
+case "$action" in
+newcert)
+	# The certificate was issued or renewed.
+	cp "$LFACME_CERTFILE" __PREFIX__/etc/nginx/tls/cert.pem
+	cp "$LFACME_KEYFILE" __PREFIX__/etc/nginx/tls/key.pem
+	nginx -s reload
+	;;
+
+*)
+	# Ignore unknown actions, because new ones might be added later.
+	;;
+esac
diff --git a/http.sh b/http.sh
deleted file mode 100644
index 0ae034e..0000000
--- a/http.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-#! /bin/sh
-# This source code is released into the public domain.
-
-. /usr/local/share/lfacme/init.sh
-
-# begin, done or failed
-ACTION=$1
-# ACME method, must be http-01.
-METHOD=$2
-# The full domain name we're authorising.
-DOMAIN=$3
-# Token name.
-TOKEN=$4
-# The token value we need to create.
-AUTH=$5
-
-if [ "$#" -ne 5 ]; then
-	_fatal "missing arguments"
-fi
-
-if [ "$METHOD" != "http-01" ]; then
-	exit 1
-fi
-
-if [ -z "$ACME_HTTP_CHALLENGE_DIR" ]; then
-	_fatal "must set ACME_HTTP_CHALLENGE_DIR"
-fi
-
-if ! [ -d "$ACME_HTTP_CHALLENGE_DIR" ]; then
-	_fatal "missing $ACME_HTTP_CHALLENGE_DIR"
-fi
-
-_file="${ACME_HTTP_CHALLENGE_DIR}/${TOKEN}"
-
-case "$ACTION" in
-	begin)
-		_verbose "creating validation token %s" "$_file"
-		echo "$AUTH" >"$_file"
-		exit $?
-		;;
-
-	done|failed)
-		_verbose "deleting validation token %s" "$_file"
-		rm -f "$_file"
-		exit $?
-		;;
-
-	*)
-		_fatal "unknown action: %s" "$ACTION"
-		;;
-esac
diff --git a/http.sh.in b/http.sh.in
new file mode 100644
index 0000000..048870e
--- /dev/null
+++ b/http.sh.in
@@ -0,0 +1,51 @@
+#! /bin/sh
+# This source code is released into the public domain.
+
+. __LIBDIR__/init.sh
+
+# begin, done or failed
+ACTION=$1
+# ACME method, must be http-01.
+METHOD=$2
+# The full domain name we're authorising.
+DOMAIN=$3
+# Token name.
+TOKEN=$4
+# The token value we need to create.
+AUTH=$5
+
+if [ "$#" -ne 5 ]; then
+	_fatal "missing arguments"
+fi
+
+if [ "$METHOD" != "http-01" ]; then
+	exit 1
+fi
+
+if [ -z "$ACME_HTTP_CHALLENGE_DIR" ]; then
+	_fatal "must set ACME_HTTP_CHALLENGE_DIR"
+fi
+
+if ! [ -d "$ACME_HTTP_CHALLENGE_DIR" ]; then
+	_fatal "missing $ACME_HTTP_CHALLENGE_DIR"
+fi
+
+_file="${ACME_HTTP_CHALLENGE_DIR}/${TOKEN}"
+
+case "$ACTION" in
+	begin)
+		_verbose "creating validation token %s" "$_file"
+		echo "$AUTH" >"$_file"
+		exit $?
+		;;
+
+	done|failed)
+		_verbose "deleting validation token %s" "$_file"
+		rm -f "$_file"
+		exit $?
+		;;
+
+	*)
+		_fatal "unknown action: %s" "$ACTION"
+		;;
+esac
diff --git a/init.sh b/init.sh
deleted file mode 100644
index c48e942..0000000
--- a/init.sh
+++ /dev/null
@@ -1,158 +0,0 @@
-# This source code is released into the public domain.
-
-_PROGNAME="$0"
-
-_fatal() {
-	local _fmt=$1; shift
-	local _msg="$(printf "$_fmt" "$@")"
-	printf >&2 '%s: FATAL: %s\n' "$_PROGNAME" "$_msg"
-	exit 1
-}
-
-_error() {
-	local _fmt=$1; shift
-	local _msg="$(printf "$_fmt" "$@")"
-	printf >&2 '%s: ERROR: %s\n' "$_PROGNAME" "$_msg"
-}
-
-_warn() {
-	local _fmt=$1; shift
-	local _msg="$(printf "$_fmt" "$@")"
-	printf >&2 '%s: WARNING: %s\n' "$_PROGNAME" "$_msg"
-}
-
-_info() {
-	local _fmt=$1; shift
-	local _msg="$(printf "$_fmt" "$@")"
-	printf '%s: %s\n' "$_PROGNAME" "$_msg"
-}
-
-_verbose() {
-	if [ -z "$LFACME_VERBOSE" ]; then
-		return
-	fi
-
-	local _fmt=$1; shift
-	local _msg="$(printf "$_fmt" "$@")"
-	printf '%s: %s\n' "$_PROGNAME" "$_msg"
-}
-
-# The prefix we're installed in.
-_BASEDIR="/usr/local"
-# Where the internal scripts are.
-_SHARE="${_BASEDIR}/share/lfacme"
-_CHALLENGE="${_SHARE}/challenge"
-
-# Our configuration directory.  If $_CONFDIR is already set, then the script
-# wants to provide its own config directory, probably from a command line
-# argument.  Otherwise if $LFACME_CONFDIR is set, we're running in a hook
-# script, so use that as the config directory.  Otherwise, use the default.
-if [ -z "$_CONFDIR" ]; then
-	if ! [ -z "$LFACME_CONFDIR" ]; then
-		_CONFDIR="$LFACME_CONFDIR"
-	else
-		_CONFDIR="${_BASEDIR}/etc/lfacme"
-	fi
-fi
-
-# Our configuration file.
-_CONFIG="${_CONFDIR}/acme.conf"
-
-# Read and validate the configuration file.
-
-if [ -f "$_CONFIG" ]; then
-	. "$_CONFIG"
-fi
-
-if [ -z "$ACME_URL" ]; then
-	_fatal "missing configuration setting: ACME_URL"
-fi
-
-if [ -z "$ACME_DATADIR" ]; then
-	ACME_DATADIR="/var/db/lfacme"
-fi
-
-if [ -z "$ACME_HOOKDIR" ]; then
-	ACME_HOOKDIR="${_CONFDIR}/hooks"
-fi
-
-# Create our data directory.
-if [ ! -d "$ACME_DATADIR" ]; then
-	_info "creating directory %s" "$ACME_DATADIR"
-	mkdir -p "$ACME_DATADIR"
-fi
-
-# The domains.conf file.
-_DOMAINS="${_CONFDIR}/domains.conf"
-
-# uacme's base directory; this is where it puts certificates.
-_UACME_DIR="${ACME_DATADIR}/certs"
-
-# The uacme executable.
-_UACME=/usr/local/bin/uacme
-
-_LFACME_UACME_FLAGS=""
-if ! [ -z "$LFACME_VERBOSE" ]; then
-	_LFACME_UACME_FLAGS="$_LFACME_UACME_FLAGS -v"
-fi
-
-_uacme() {
-	env	"LFACME_CONFDIR=${_CONFDIR}"		\
-		"LFACME_VERBOSE=${LFACME_VERBOSE}"	\
-		"$_UACME" $_LFACME_UACME_FLAGS 		\
-		-a "$ACME_URL" -c "$_UACME_DIR" "$@"
-}
-
-# Find a challenge script and make sure it's valid.  If the challenge name
-# begins with a '/' it's a full path, otherwise we search $_CHALLENGE and
-# $_CONFDIR/challenge.
-_findchallenge() {
-	local identifier="$1"
-	local challenge="$2"
-	local path=""
-
-	if [ "${challenge#/*}" != "$challenge" ]; then
-		path="${challenge}"
-	elif [ -f "${_CHALLENGE}/${challenge}" ]; then
-		path="${_CHALLENGE}/${challenge}"
-	elif [ -f "${_CONFDIR}/challenge/${challenge}" ]; then
-		path="${_CONFDIR}/challenge/${challenge}"
-	else
-		_error "%s: could not find challenge script '%s'" \
-			"$identifier" "$challenge"
-		return 1
-	fi
-
-	if ! [ -x "$path" ]; then
-		_error "%s: challenge is not executable: %s" \
-			"$identifier" "$path"
-		return 1
-	fi
-
-	echo "$path"
-}
-
-# Find a hook script and make sure it's valid.  If the hook name begins with a
-# '/' it's a full path, otherwise it's relative to ACME_HOOKDIR.
-_findhook() {
-	local identifier="$1"
-	local hook="$2"
-
-	if [ "${hook#/*}" = "$hook" ]; then
-		hook="${ACME_HOOKDIR}/$hook"
-	fi
-
-	if ! [ -f "$hook" ]; then
-		_error "%s: hook does not exist: %s" \
-			"$identifier" "$hook"
-		return 1
-	fi
-
-	if ! [ -x "$hook" ]; then
-		_error "%s: hook is not executable: %s" \
-			"$identifier" "$hook"
-		return 1
-	fi
-
-	echo "$hook"
-}
diff --git a/init.sh.in b/init.sh.in
new file mode 100644
index 0000000..c70285c
--- /dev/null
+++ b/init.sh.in
@@ -0,0 +1,158 @@
+# This source code is released into the public domain.
+
+_PROGNAME="$0"
+
+_fatal() {
+	local _fmt=$1; shift
+	local _msg="$(printf "$_fmt" "$@")"
+	printf >&2 '%s: FATAL: %s\n' "$_PROGNAME" "$_msg"
+	exit 1
+}
+
+_error() {
+	local _fmt=$1; shift
+	local _msg="$(printf "$_fmt" "$@")"
+	printf >&2 '%s: ERROR: %s\n' "$_PROGNAME" "$_msg"
+}
+
+_warn() {
+	local _fmt=$1; shift
+	local _msg="$(printf "$_fmt" "$@")"
+	printf >&2 '%s: WARNING: %s\n' "$_PROGNAME" "$_msg"
+}
+
+_info() {
+	local _fmt=$1; shift
+	local _msg="$(printf "$_fmt" "$@")"
+	printf '%s: %s\n' "$_PROGNAME" "$_msg"
+}
+
+_verbose() {
+	if [ -z "$LFACME_VERBOSE" ]; then
+		return
+	fi
+
+	local _fmt=$1; shift
+	local _msg="$(printf "$_fmt" "$@")"
+	printf '%s: %s\n' "$_PROGNAME" "$_msg"
+}
+
+# The prefix we're installed in.
+_BASEDIR="__PREFIX__"
+# Where the internal scripts are.
+_SHARE="${_BASEDIR}/share/lfacme"
+_CHALLENGE="${_SHARE}/challenge"
+
+# Our configuration directory.  If $_CONFDIR is already set, then the script
+# wants to provide its own config directory, probably from a command line
+# argument.  Otherwise if $LFACME_CONFDIR is set, we're running in a hook
+# script, so use that as the config directory.  Otherwise, use the default.
+if [ -z "$_CONFDIR" ]; then
+	if ! [ -z "$LFACME_CONFDIR" ]; then
+		_CONFDIR="$LFACME_CONFDIR"
+	else
+		_CONFDIR="${_BASEDIR}/etc/lfacme"
+	fi
+fi
+
+# Our configuration file.
+_CONFIG="${_CONFDIR}/acme.conf"
+
+# Read and validate the configuration file.
+
+if [ -f "$_CONFIG" ]; then
+	. "$_CONFIG"
+fi
+
+if [ -z "$ACME_URL" ]; then
+	_fatal "missing configuration setting: ACME_URL"
+fi
+
+if [ -z "$ACME_DATADIR" ]; then
+	ACME_DATADIR="/var/db/lfacme"
+fi
+
+if [ -z "$ACME_HOOKDIR" ]; then
+	ACME_HOOKDIR="${_CONFDIR}/hooks"
+fi
+
+# Create our data directory.
+if [ ! -d "$ACME_DATADIR" ]; then
+	_info "creating directory %s" "$ACME_DATADIR"
+	mkdir -p "$ACME_DATADIR"
+fi
+
+# The domains.conf file.
+_DOMAINS="${_CONFDIR}/domains.conf"
+
+# uacme's base directory; this is where it puts certificates.
+_UACME_DIR="${ACME_DATADIR}/certs"
+
+# The uacme executable.
+_UACME=uacme
+
+_LFACME_UACME_FLAGS=""
+if ! [ -z "$LFACME_VERBOSE" ]; then
+	_LFACME_UACME_FLAGS="$_LFACME_UACME_FLAGS -v"
+fi
+
+_uacme() {
+	env	"LFACME_CONFDIR=${_CONFDIR}"		\
+		"LFACME_VERBOSE=${LFACME_VERBOSE}"	\
+		"$_UACME" $_LFACME_UACME_FLAGS 		\
+		-a "$ACME_URL" -c "$_UACME_DIR" "$@"
+}
+
+# Find a challenge script and make sure it's valid.  If the challenge name
+# begins with a '/' it's a full path, otherwise we search $_CHALLENGE and
+# $_CONFDIR/challenge.
+_findchallenge() {
+	local identifier="$1"
+	local challenge="$2"
+	local path=""
+
+	if [ "${challenge#/*}" != "$challenge" ]; then
+		path="${challenge}"
+	elif [ -f "${_CHALLENGE}/${challenge}" ]; then
+		path="${_CHALLENGE}/${challenge}"
+	elif [ -f "${_CONFDIR}/challenge/${challenge}" ]; then
+		path="${_CONFDIR}/challenge/${challenge}"
+	else
+		_error "%s: could not find challenge script '%s'" \
+			"$identifier" "$challenge"
+		return 1
+	fi
+
+	if ! [ -x "$path" ]; then
+		_error "%s: challenge is not executable: %s" \
+			"$identifier" "$path"
+		return 1
+	fi
+
+	echo "$path"
+}
+
+# Find a hook script and make sure it's valid.  If the hook name begins with a
+# '/' it's a full path, otherwise it's relative to ACME_HOOKDIR.
+_findhook() {
+	local identifier="$1"
+	local hook="$2"
+
+	if [ "${hook#/*}" = "$hook" ]; then
+		hook="${ACME_HOOKDIR}/$hook"
+	fi
+
+	if ! [ -f "$hook" ]; then
+		_error "%s: hook does not exist: %s" \
+			"$identifier" "$hook"
+		return 1
+	fi
+
+	if ! [ -x "$hook" ]; then
+		_error "%s: hook is not executable: %s" \
+			"$identifier" "$hook"
+		return 1
+	fi
+
+	echo "$hook"
+}
diff --git a/kerberos.sh b/kerberos.sh
deleted file mode 100644
index 543abc6..0000000
--- a/kerberos.sh
+++ /dev/null
@@ -1,86 +0,0 @@
-#! /bin/sh
-# This source code is released into the public domain.
-
-. /usr/local/share/lfacme/init.sh
-. /usr/local/share/lfacme/dnsutils.sh
-
-# begin, done or failed
-ACTION=$1
-# ACME method, must be dns-01.
-METHOD=$2
-# This is the full domain name we're authorising.
-DOMAIN=$3
-# Token name, not used for dns-01.
-TOKEN=$4
-# The token value we need to create.
-AUTH=$5
-
-if [ "$#" -ne 5 ]; then
-	_fatal "missing arguments"
-fi
-
-if [ "$METHOD" != "dns-01" ]; then
-	exit 1
-fi
-
-if [ -z "$ACME_KERBEROS_PRINCIPAL" ]; then
-	ACME_KERBEROS_PRINCIPAL="host/$(hostname)"
-fi
-
-if [ -z "$ACME_KERBEROS_KEYTAB" ]; then
-	ACME_KERBEROS_KEYTAB="/etc/krb5.keytab"
-fi
-
-if ! kinit -k -t "$ACME_KERBEROS_KEYTAB" "$ACME_KERBEROS_PRINCIPAL"; then
-	_fatal "failed to obtain a Kerberos ticket"
-fi
-
-# Add a new record using nsupdate.
-_add_record() {
-	local domain="$1"
-	local auth="$2"
-
-	nsupdate -g <<EOF
-update add _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
-send
-EOF
-	return $?
-}
-
-# Remove an existing record using nsupdate.
-_remove_record() {
-	local domain="$1"
-	local auth="$2"
-
-	nsupdate -g <<EOF
-update delete _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
-send
-EOF
-	return $?
-}
-
-case "$ACTION" in
-	begin)
-		if ! _add_record "$DOMAIN" "$AUTH"; then
-			_fatal "failed to add the DNS record for %s" "$DOMAIN"
-			exit 1
-		fi
-
-		if ! lfacme_dns_wait_for_record "$DOMAIN" "$AUTH"; then
-			_fatal "timed out waiting for the DNS record for '%s' to be published" \
-				"$DOMAIN"
-			exit 1
-		fi
-
-		exit 0
-		;;
-
-	done|failed)
-		_remove_record "$DOMAIN" "$AUTH"
-		exit $?
-		;;
-
-	*)
-		_fatal "unknown action: %s" "$ACTION"
-		;;
-esac
diff --git a/kerberos.sh.in b/kerberos.sh.in
new file mode 100644
index 0000000..41d99c2
--- /dev/null
+++ b/kerberos.sh.in
@@ -0,0 +1,86 @@
+#! /bin/sh
+# This source code is released into the public domain.
+
+. __LIBDIR__/init.sh
+. __LIBDIR__/dnsutils.sh
+
+# begin, done or failed
+ACTION=$1
+# ACME method, must be dns-01.
+METHOD=$2
+# This is the full domain name we're authorising.
+DOMAIN=$3
+# Token name, not used for dns-01.
+TOKEN=$4
+# The token value we need to create.
+AUTH=$5
+
+if [ "$#" -ne 5 ]; then
+	_fatal "missing arguments"
+fi
+
+if [ "$METHOD" != "dns-01" ]; then
+	exit 1
+fi
+
+if [ -z "$ACME_KERBEROS_PRINCIPAL" ]; then
+	ACME_KERBEROS_PRINCIPAL="host/$(hostname)"
+fi
+
+if [ -z "$ACME_KERBEROS_KEYTAB" ]; then
+	ACME_KERBEROS_KEYTAB="/etc/krb5.keytab"
+fi
+
+if ! kinit -k -t "$ACME_KERBEROS_KEYTAB" "$ACME_KERBEROS_PRINCIPAL"; then
+	_fatal "failed to obtain a Kerberos ticket"
+fi
+
+# Add a new record using nsupdate.
+_add_record() {
+	local domain="$1"
+	local auth="$2"
+
+	nsupdate -g <<EOF
+update add _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
+send
+EOF
+	return $?
+}
+
+# Remove an existing record using nsupdate.
+_remove_record() {
+	local domain="$1"
+	local auth="$2"
+
+	nsupdate -g <<EOF
+update delete _acme-challenge.${DOMAIN}. 300 IN TXT "${AUTH}"
+send
+EOF
+	return $?
+}
+
+case "$ACTION" in
+	begin)
+		if ! _add_record "$DOMAIN" "$AUTH"; then
+			_fatal "failed to add the DNS record for %s" "$DOMAIN"
+			exit 1
+		fi
+
+		if ! lfacme_dns_wait_for_record "$DOMAIN" "$AUTH"; then
+			_fatal "timed out waiting for the DNS record for '%s' to be published" \
+				"$DOMAIN"
+			exit 1
+		fi
+
+		exit 0
+		;;
+
+	done|failed)
+		_remove_record "$DOMAIN" "$AUTH"
+		exit $?
+		;;
+
+	*)
+		_fatal "unknown action: %s" "$ACTION"
+		;;
+esac
diff --git a/lfacme-dns.7 b/lfacme-dns.7
deleted file mode 100644
index 5e46215..0000000
--- a/lfacme-dns.7
+++ /dev/null
@@ -1,61 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 4, 2025
-.Dt LFACME-DNS 7
-.Os
-.Sh NAME
-.Nm lfacme-dns
-.Nd validate an ACME challenge via TSIG DNS updates
-.Sh SYNOPSIS
-In
-.Xr domains.conf 5 :
-.Bd -ragged -offset indent
-.Ar domain
-challenge=dns
-.Ed
-.Sh DESCRIPTION
-The
-.Nm
-challenge hook will respond to an ACME domain validation using a DNS-based
-.Dq dns-01
-authorization with TSIG-authenticated Dynamic DNS updates.
-To use this challenge hook, configure one or more domains with
-.Dq challenge=dns
-in
-.Xr domains.conf 5 .
-.Pp
-The
-.Dq dns-01
-challenge expects the authorization token to be created as a TXT record at the
-DNS name
-.Dq _acme-challenge. Ns Ar domain .
-When
-.Nm
-responds to the challenge, it will use
-.Xr nsupdate 1
-to create this record.
-The DNS update will be sent to the zone's master server (determined by the
-MNAME field in the SOA record), and will be authenticated using the TSIG
-key file configured by
-.Ar ACME_DNS_KEYFILE
-in
-.Xr acme.conf 5 .
-.Pp
-Once validation is complete, the previously created DNS record will be removed.
-.Sh CONFIGURATION
-The
-.Nm
-challenge hook supports the following configuration options in
-.Xr acme.conf 5 :
-.Bl -tag -width indent
-.It Va ACME_DNS_KEYFILE
-(Required.)
-The key file that will be passed to
-.Xr nsupdate 1
-to authenticate the DNS update.
-.El
-.Sh SEE ALSO
-.Xr acme.conf 5 ,
-.Xr domains.conf 5 ,
-.Xr lfacme 7 ,
-.Xr lfacme-renew 8 ,
-.Xr nsupdate 1
diff --git a/lfacme-dns.7.in b/lfacme-dns.7.in
new file mode 100644
index 0000000..5e46215
--- /dev/null
+++ b/lfacme-dns.7.in
@@ -0,0 +1,61 @@
+.\" This source code is released into the public domain.
+.Dd June 4, 2025
+.Dt LFACME-DNS 7
+.Os
+.Sh NAME
+.Nm lfacme-dns
+.Nd validate an ACME challenge via TSIG DNS updates
+.Sh SYNOPSIS
+In
+.Xr domains.conf 5 :
+.Bd -ragged -offset indent
+.Ar domain
+challenge=dns
+.Ed
+.Sh DESCRIPTION
+The
+.Nm
+challenge hook will respond to an ACME domain validation using a DNS-based
+.Dq dns-01
+authorization with TSIG-authenticated Dynamic DNS updates.
+To use this challenge hook, configure one or more domains with
+.Dq challenge=dns
+in
+.Xr domains.conf 5 .
+.Pp
+The
+.Dq dns-01
+challenge expects the authorization token to be created as a TXT record at the
+DNS name
+.Dq _acme-challenge. Ns Ar domain .
+When
+.Nm
+responds to the challenge, it will use
+.Xr nsupdate 1
+to create this record.
+The DNS update will be sent to the zone's master server (determined by the
+MNAME field in the SOA record), and will be authenticated using the TSIG
+key file configured by
+.Ar ACME_DNS_KEYFILE
+in
+.Xr acme.conf 5 .
+.Pp
+Once validation is complete, the previously created DNS record will be removed.
+.Sh CONFIGURATION
+The
+.Nm
+challenge hook supports the following configuration options in
+.Xr acme.conf 5 :
+.Bl -tag -width indent
+.It Va ACME_DNS_KEYFILE
+(Required.)
+The key file that will be passed to
+.Xr nsupdate 1
+to authenticate the DNS update.
+.El
+.Sh SEE ALSO
+.Xr acme.conf 5 ,
+.Xr domains.conf 5 ,
+.Xr lfacme 7 ,
+.Xr lfacme-renew 8 ,
+.Xr nsupdate 1
diff --git a/lfacme-http.7 b/lfacme-http.7
deleted file mode 100644
index 25b7aac..0000000
--- a/lfacme-http.7
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 4, 2025
-.Dt LFACME-HTTP 7
-.Os
-.Sh NAME
-.Nm lfacme-http
-.Nd validate an ACME challenge via HTTP
-.Sh SYNOPSIS
-In
-.Xr domains.conf 5 :
-.Bd -ragged -offset indent
-.Ar domain
-challenge=http
-.Ed
-.Sh DESCRIPTION
-The
-.Nm
-challenge hook will respond to an ACME domain validation using an HTTP-based
-.Dq http-01
-authorization.
-To use this challenge hook, configure one or more domains with
-.Dq challenge=http
-in
-.Xr domains.conf 5 .
-.Pp
-The
-.Dq http-01
-challenge expects the authorization token to be served via HTTP at the path
-.Dq /.well-known/acme-challenge/ Ns Ar token
-on the domain to be validated.
-When
-.Nm
-responds to the challenge, it will place the token in the directory configured
-by
-.Ar ACME_HTTP_CHALLENGE_DIR
-in
-.Xr acme.conf 5 .
-This directory must be mapped to the appropriate path on the web server for
-the challenge to succeed.
-.Sh CONFIGURATION
-The
-.Nm
-challenge hook supports the following configuration options in
-.Xr acme.conf 5 :
-.Bl -tag -width indent
-.It Va ACME_HTTP_CHALLENGE_DIR
-(Required.)
-The directory to place the challenge tokens in.
-The contents of this directory should be served at the path
-.Dq /.well-known/acme-challenge
-on the web server for the domain to be validated.
-.El
-.Sh SEE ALSO
-.Xr acme.conf 5 ,
-.Xr domains.conf 5 ,
-.Xr lfacme 7 ,
-.Xr lfacme-renew 8
diff --git a/lfacme-http.7.in b/lfacme-http.7.in
new file mode 100644
index 0000000..25b7aac
--- /dev/null
+++ b/lfacme-http.7.in
@@ -0,0 +1,57 @@
+.\" This source code is released into the public domain.
+.Dd June 4, 2025
+.Dt LFACME-HTTP 7
+.Os
+.Sh NAME
+.Nm lfacme-http
+.Nd validate an ACME challenge via HTTP
+.Sh SYNOPSIS
+In
+.Xr domains.conf 5 :
+.Bd -ragged -offset indent
+.Ar domain
+challenge=http
+.Ed
+.Sh DESCRIPTION
+The
+.Nm
+challenge hook will respond to an ACME domain validation using an HTTP-based
+.Dq http-01
+authorization.
+To use this challenge hook, configure one or more domains with
+.Dq challenge=http
+in
+.Xr domains.conf 5 .
+.Pp
+The
+.Dq http-01
+challenge expects the authorization token to be served via HTTP at the path
+.Dq /.well-known/acme-challenge/ Ns Ar token
+on the domain to be validated.
+When
+.Nm
+responds to the challenge, it will place the token in the directory configured
+by
+.Ar ACME_HTTP_CHALLENGE_DIR
+in
+.Xr acme.conf 5 .
+This directory must be mapped to the appropriate path on the web server for
+the challenge to succeed.
+.Sh CONFIGURATION
+The
+.Nm
+challenge hook supports the following configuration options in
+.Xr acme.conf 5 :
+.Bl -tag -width indent
+.It Va ACME_HTTP_CHALLENGE_DIR
+(Required.)
+The directory to place the challenge tokens in.
+The contents of this directory should be served at the path
+.Dq /.well-known/acme-challenge
+on the web server for the domain to be validated.
+.El
+.Sh SEE ALSO
+.Xr acme.conf 5 ,
+.Xr domains.conf 5 ,
+.Xr lfacme 7 ,
+.Xr lfacme-renew 8
diff --git a/lfacme-kerberos.7 b/lfacme-kerberos.7
deleted file mode 100644
index b3afd0c..0000000
--- a/lfacme-kerberos.7
+++ /dev/null
@@ -1,75 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 4, 2025
-.Dt LFACME-KERBEROS 7
-.Os
-.Sh NAME
-.Nm lfacme-kerberos
-.Nd validate an ACME challenge via GSS-TSIG DNS updates
-.Sh SYNOPSIS
-In
-.Xr domains.conf 5 :
-.Bd -ragged -offset indent
-.Ar domain
-challenge=kerberos
-.Ed
-.Sh DESCRIPTION
-The
-.Nm
-challenge hook will respond to an ACME domain validation using a DNS-based
-.Dq dns-01
-authorization with GSS-TSIG Dynamic DNS updates.
-To use this challenge hook, configure one or more domains with
-.Dq challenge=kerberos
-in
-.Xr domains.conf 5 .
-.Pp
-The
-.Dq dns-01
-challenge expects the authorization token to be created as a TXT record at the
-DNS name
-.Dq _acme-challenge. Ns Ar domain .
-When
-.Nm
-responds to the challenge, it will use
-.Xr nsupdate 1
-with the 
-.Fl g
-flag to create this token.
-The DNS update will be sent to the zone's master server, as determined by the
-MNAME field in the SOA record.
-.Pp
-Before sending the update,
-.Nm
-will retrieve a Kerberos ticket using
-.Xr kinit 1
-for the principal configured by
-.Ar ACME_KERBEROS_PRINCIPAL
-in
-.Xr acme.conf 5 .
-.Sh CONFIGURATION
-The
-.Nm
-challenge hook supports the following configuration options in
-.Xr acme.conf 5 :
-.Bl -tag -width indent
-.It Va ACME_KERBEROS_PRINCIPAL
-The Kerberos principal to authenticate as when sending the DNS update.
-The default value is
-.Dq host/$(hostname) ,
-which assumes a default realm has been configured in
-.Pa /etc/krb5.conf .
-Explicitly configuring the principal is recommended, but not required.
-.It Va ACME_KERBEROS_KEYTAB
-The keytab used to issue the Kerberos ticket.
-This must contain a key for the principal configured by
-.Va ACME_KERBEROS_PRINCIPAL .
-The default value is
-.Pa /etc/krb5.keytab .
-.El
-.Sh SEE ALSO
-.Xr acme.conf 5 ,
-.Xr domains.conf 5 ,
-.Xr kinit 1 ,
-.Xr lfacme 7 ,
-.Xr lfacme-renew 8 ,
-.Xr nsupdate 1
diff --git a/lfacme-kerberos.7.in b/lfacme-kerberos.7.in
new file mode 100644
index 0000000..b3afd0c
--- /dev/null
+++ b/lfacme-kerberos.7.in
@@ -0,0 +1,75 @@
+.\" This source code is released into the public domain.
+.Dd June 4, 2025
+.Dt LFACME-KERBEROS 7
+.Os
+.Sh NAME
+.Nm lfacme-kerberos
+.Nd validate an ACME challenge via GSS-TSIG DNS updates
+.Sh SYNOPSIS
+In
+.Xr domains.conf 5 :
+.Bd -ragged -offset indent
+.Ar domain
+challenge=kerberos
+.Ed
+.Sh DESCRIPTION
+The
+.Nm
+challenge hook will respond to an ACME domain validation using a DNS-based
+.Dq dns-01
+authorization with GSS-TSIG Dynamic DNS updates.
+To use this challenge hook, configure one or more domains with
+.Dq challenge=kerberos
+in
+.Xr domains.conf 5 .
+.Pp
+The
+.Dq dns-01
+challenge expects the authorization token to be created as a TXT record at the
+DNS name
+.Dq _acme-challenge. Ns Ar domain .
+When
+.Nm
+responds to the challenge, it will use
+.Xr nsupdate 1
+with the 
+.Fl g
+flag to create this token.
+The DNS update will be sent to the zone's master server, as determined by the
+MNAME field in the SOA record.
+.Pp
+Before sending the update,
+.Nm
+will retrieve a Kerberos ticket using
+.Xr kinit 1
+for the principal configured by
+.Ar ACME_KERBEROS_PRINCIPAL
+in
+.Xr acme.conf 5 .
+.Sh CONFIGURATION
+The
+.Nm
+challenge hook supports the following configuration options in
+.Xr acme.conf 5 :
+.Bl -tag -width indent
+.It Va ACME_KERBEROS_PRINCIPAL
+The Kerberos principal to authenticate as when sending the DNS update.
+The default value is
+.Dq host/$(hostname) ,
+which assumes a default realm has been configured in
+.Pa /etc/krb5.conf .
+Explicitly configuring the principal is recommended, but not required.
+.It Va ACME_KERBEROS_KEYTAB
+The keytab used to issue the Kerberos ticket.
+This must contain a key for the principal configured by
+.Va ACME_KERBEROS_PRINCIPAL .
+The default value is
+.Pa /etc/krb5.keytab .
+.El
+.Sh SEE ALSO
+.Xr acme.conf 5 ,
+.Xr domains.conf 5 ,
+.Xr kinit 1 ,
+.Xr lfacme 7 ,
+.Xr lfacme-renew 8 ,
+.Xr nsupdate 1
diff --git a/lfacme-renew.8 b/lfacme-renew.8
deleted file mode 100644
index 5d54e17..0000000
--- a/lfacme-renew.8
+++ /dev/null
@@ -1,48 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 3, 2025
-.Dt LFACME-RENEW 8
-.Os
-.Sh NAME
-.Nm lfacme-renew
-.Nd issue or renew ACME certificates
-.Sh SYNOPSIS
-.Nm
-.Op Fl v
-.Op Fl c Ar confdir
-.Sh DESCRIPTION
-The
-.Nm
-utility examines the ACME certificates configured in
-.Xr domains.conf 5 .
-If a certificate was previously issued and is still valid for longer than 30
-days, it will be ignored.
-Otherwise, the certificate will be issued or renewed and any configured hook
-scripts will be invoked.
-.Pp
-An ACME account must be created using
-.Xr lfacme-setup 8
-before running
-.Nm .
-.Pp
-The follow options are accepted:
-.Bl -tag -width indent
-.It Fl c Ar confdir
-Use
-.Ar confdir
-as the configuration directory instead of the default
-.Pa /usr/local/etc/lfacme .
-.It Fl v
-Produce more output when running.
-This also passes the
-.Fl v
-option to uacme.
-.El
-.Sh ENVIRONMENT
-Refer to
-.Xr lfacme 8
-for a list of environment variables which affect the operation of
-.Nm .
-.Sh SEE ALSO
-.Xr domains.conf 5 ,
-.Xr lfacme 7 ,
-.Xr lfacme-setup 8
diff --git a/lfacme-renew.8.in b/lfacme-renew.8.in
new file mode 100644
index 0000000..66d9f3d
--- /dev/null
+++ b/lfacme-renew.8.in
@@ -0,0 +1,48 @@
+.\" This source code is released into the public domain.
+.Dd June 3, 2025
+.Dt LFACME-RENEW 8
+.Os
+.Sh NAME
+.Nm lfacme-renew
+.Nd issue or renew ACME certificates
+.Sh SYNOPSIS
+.Nm
+.Op Fl v
+.Op Fl c Ar confdir
+.Sh DESCRIPTION
+The
+.Nm
+utility examines the ACME certificates configured in
+.Xr domains.conf 5 .
+If a certificate was previously issued and is still valid for longer than 30
+days, it will be ignored.
+Otherwise, the certificate will be issued or renewed and any configured hook
+scripts will be invoked.
+.Pp
+An ACME account must be created using
+.Xr lfacme-setup 8
+before running
+.Nm .
+.Pp
+The follow options are accepted:
+.Bl -tag -width indent
+.It Fl c Ar confdir
+Use
+.Ar confdir
+as the configuration directory instead of the default
+.Pa __CONFDIR__ .
+.It Fl v
+Produce more output when running.
+This also passes the
+.Fl v
+option to uacme.
+.El
+.Sh ENVIRONMENT
+Refer to
+.Xr lfacme 8
+for a list of environment variables which affect the operation of
+.Nm .
+.Sh SEE ALSO
+.Xr domains.conf 5 ,
+.Xr lfacme 7 ,
+.Xr lfacme-setup 8
diff --git a/lfacme-renew.sh b/lfacme-renew.sh
deleted file mode 100644
index 0dc0392..0000000
--- a/lfacme-renew.sh
+++ /dev/null
@@ -1,269 +0,0 @@
-#! /bin/sh
-# This source code is released into the public domain.
-
-# Parse command-line arguments.
-args=$(getopt c:v $*)
-if [ $? -ne 0 ]; then
-	exit 1
-fi
-set -- $args
-
-# ARI is broken due to https://github.com/ndilieto/uacme/issues/91
-_uacme_flags="--no-ari"
-
-while :; do
-	case "$1" in
-	-c)
-		_CONFDIR="$2"
-		shift; shift;;
-	-v)
-		LFACME_VERBOSE=1
-		shift;;
-	--)
-		shift; break;;
-	esac
-done
-
-# Initialise.
-. /usr/local/share/lfacme/init.sh
-
-if ! [ -f "$_UACME_DIR/private/key.pem" ]; then
-	_fatal "run lfacme-setup first"
-fi
-
-if ! [ -f "$_DOMAINS" ]; then
-	_fatal "missing $_DOMAINS"
-fi
-
-# Create a key if it doesn't already exist.  It would be better to always
-# create a new key here, but currently uacme doesn't have a way to tell us
-# that we need to do that.
-_make_key() {
-	local keytype="$1"
-	local keyfile="$2"
-
-	if [ -s "$keyfile" ]; then
-		return 0
-	fi
-
-	local _umask=$(umask)
-	umask 077
-
-	case $keytype in
-	ec)	openssl ecparam -name secp384r1 -genkey -noout -out "$keyfile";;
-	rsa)	openssl genrsa -out "$keyfile" 3072;;
-	*)	_error "%s: unknown key type %s?" "$keyfile" "$keytype"
-		return 1;;
-	esac
-
-	local _ret=$?
-	umask $_umask
-
-	return $_ret
-}
-
-# Create a new CSR for a domain.
-_make_csr() {
-	local csrfile="$1"
-	local keyfile="$2"
-	local domain="$3"
-	local altnames="$4"
-	local csrconf="${csrfile}.cnf"
-
-	cat >"$csrconf" <<EOF
-[req] 
-distinguished_name = req_distinguished_name
-req_extensions = req_ext
-prompt = no
-
-[req_distinguished_name] 
-commonName = $domain
-
-[req_ext] 
-subjectAltName = @alt_names 
-
-[alt_names] 
-DNS.1 = $domain
-EOF
-	
-	local _i=2
-	for altname in $altnames; do
-		printf >>"$csrconf" 'DNS.%d = %s\n' "$_i" "$altname"
-		_i=$((_i + 1))
-	done
-
-	# Generate the CSR
-	openssl req -new -key "$keyfile" -out "$csrfile" -config "$csrconf"
-	return $?
-}
-
-# Process a single cert.
-_docert() {
-	local identifier="$1"; shift
-
-	_verbose "checking certificate '%s'" "$identifier"
-
-	# uacme creates the cert name by stripping the extension from the
-	# CSR filename, so the basename has to match the identifier.
-	local dir="${_UACME_DIR}/${identifier}"
-	local keyfile="${dir}/${identifier}-key.pem"
-	local csrfile="${dir}/${identifier}.csr"
-	local certfile="${dir}/${identifier}-cert.pem"
-
-	# these can be overridden by args
-	local keytype=""
-	local altnames=""
-	local hooks=""
-	local domain=""
-	local challenge=""
-
-	# parse arguments for this cert
-	while ! [ -z "$1" ]; do
-		case "$1" in
-		type=rsa)
-			keytype=rsa
-			;;
-		type=ec)
-			keytype=ec
-			;;
-		type=*)
-			_error "%s: unknown key type: %s" \
-				"$identifier" "${1#type=*}"
-			return 1
-			;;
-		hook=*)
-			hooks="$hooks ${1#hook=*}"
-			;;
-		challenge=*)
-			challenge="${1#challenge=*}"
-			;;
-		*=*)
-			_error "%s: unknown option: %s" "$identifier" "$1"
-			return 1
-			;;
-		*.*)
-			altnames="$altnames $1"
-			# Take the domain from the first altname.
-			if [ -z "$domain" ]; then
-				domain="$1"
-			fi
-			;;
-		*)
-			_error "%s: unknown option: %s" "$identifier" "$1"
-			return 1
-			;;
-		esac
-		shift
-	done
-
-	# If no altnames were given, the identifier is the domain.
-	if [ -z "$domain" ]; then
-		domain="$identifier"
-	fi
-
-	# Default key type is ec.
-	if [ -z "$keytype" ]; then
-		keytype="ec"
-	fi
-
-	# Default challenge is http.
-	if [ -z "$challenge" ]; then
-		challenge="http"
-	fi
-
-	# make sure the challenge is valid.
-	challenge_path="$(_findchallenge "$identifier" "$challenge")"
-	if [ -z "$challenge_path" ]; then
-		return 1
-	fi
-
-	# make sure all the hook scripts are valid.  if the hook name
-	# begins with a '/' it's a full path, otherwise it's relative
-	# to ACME_HOOKDIR.
-	local _rhooks=""
-	for hook in $hooks; do
-		local _hookpath="$(_findhook "$identifier" "$hook")"
-		if [ -z "$_hookpath" ]; then
-			return 1
-		fi
-
-		_rhooks="$_rhooks $_hookpath"
-	done
-
-	mkdir -p -m0700 "$dir"
-
-	if ! _make_key "$keytype" "$keyfile"; then
-		_error "%s: could not create a new private key" "$identifier"
-		return 1
-	fi
-
-	if ! _make_csr "$csrfile" "$keyfile" "$domain" "$altnames"; then
-		_error "%s: could not create the certificate signing request" \
-			"$identifier"
-		return 1
-	fi
-
-	_uacme $_uacme_flags 		\
-		-h "$challenge_path"	\
-		 issue "$csrfile"
-	_ret=$?
-
-	# exit 1 means the cert wasn't reissued
-	if [ "$_ret" -eq 1 ]; then
-		return 0
-	fi
-
-	# exit 2 means an actual error
-	if [ "$_ret" -eq 2 ]; then
-		_error "%s: failed to issue certificate" "$identifier"
-		return 1
-	fi
-
-	# any other non-zero exit code is unexpected
-	if [ "$_ret" -ne 0 ]; then
-		_error "%s: unexpected exit code from uacme: %d" \
-			"$identifier" "$_ret"
-		return 1
-	fi
-
-	# otherwise, exit code is 0 which means we (re)issued the cert,
-	# so run the hooks.
-	for hook in $_rhooks; do
-		_verbose "running hook: %s" "$hook"
-		env	"LFACME_CONFDIR=${_CONFDIR}"		\
-			"LFACME_VERBOSE=${LFACME_VERBOSE}"	\
-			"LFACME_CERT=${identifier}"		\
-			"LFACME_KEYFILE=${keyfile}"		\
-			"LFACME_CERTFILE=${certfile}"		\
-			"$hook" newcert
-		if [ "$?" -ne 0 ]; then
-			_warn "%s: hook script '%s' failed" \
-				"$identifier" "$hook"
-		fi
-		# should we do anything if the hook failed?
-	done
-
-	return $?
-}
-
-cat "$_DOMAINS" \
-| egrep -v '^(#|[[:space:]]*$)' \
-| (
-	_default_args=""
-	_exit=0
-
-	while read identifier args; do
-		if [ "$identifier" = "*" ]; then
-			_default_args="$args"
-			continue
-		fi
-
-		if ! _docert "$identifier" $_default_args $args; then
-			_exit=1
-		fi
-	done
-
-	exit $_exit
-)
-
-exit $?
diff --git a/lfacme-renew.sh.in b/lfacme-renew.sh.in
new file mode 100644
index 0000000..5b471c7
--- /dev/null
+++ b/lfacme-renew.sh.in
@@ -0,0 +1,269 @@
+#! /bin/sh
+# This source code is released into the public domain.
+
+# Parse command-line arguments.
+args=$(getopt c:v $*)
+if [ $? -ne 0 ]; then
+	exit 1
+fi
+set -- $args
+
+# ARI is broken due to https://github.com/ndilieto/uacme/issues/91
+_uacme_flags="--no-ari"
+
+while :; do
+	case "$1" in
+	-c)
+		_CONFDIR="$2"
+		shift; shift;;
+	-v)
+		LFACME_VERBOSE=1
+		shift;;
+	--)
+		shift; break;;
+	esac
+done
+
+# Initialise.
+. __LIBDIR__/init.sh
+
+if ! [ -f "$_UACME_DIR/private/key.pem" ]; then
+	_fatal "run lfacme-setup first"
+fi
+
+if ! [ -f "$_DOMAINS" ]; then
+	_fatal "missing $_DOMAINS"
+fi
+
+# Create a key if it doesn't already exist.  It would be better to always
+# create a new key here, but currently uacme doesn't have a way to tell us
+# that we need to do that.
+_make_key() {
+	local keytype="$1"
+	local keyfile="$2"
+
+	if [ -s "$keyfile" ]; then
+		return 0
+	fi
+
+	local _umask=$(umask)
+	umask 077
+
+	case $keytype in
+	ec)	openssl ecparam -name secp384r1 -genkey -noout -out "$keyfile";;
+	rsa)	openssl genrsa -out "$keyfile" 3072;;
+	*)	_error "%s: unknown key type %s?" "$keyfile" "$keytype"
+		return 1;;
+	esac
+
+	local _ret=$?
+	umask $_umask
+
+	return $_ret
+}
+
+# Create a new CSR for a domain.
+_make_csr() {
+	local csrfile="$1"
+	local keyfile="$2"
+	local domain="$3"
+	local altnames="$4"
+	local csrconf="${csrfile}.cnf"
+
+	cat >"$csrconf" <<EOF
+[req] 
+distinguished_name = req_distinguished_name
+req_extensions = req_ext
+prompt = no
+
+[req_distinguished_name] 
+commonName = $domain
+
+[req_ext] 
+subjectAltName = @alt_names 
+
+[alt_names] 
+DNS.1 = $domain
+EOF
+	
+	local _i=2
+	for altname in $altnames; do
+		printf >>"$csrconf" 'DNS.%d = %s\n' "$_i" "$altname"
+		_i=$((_i + 1))
+	done
+
+	# Generate the CSR
+	openssl req -new -key "$keyfile" -out "$csrfile" -config "$csrconf"
+	return $?
+}
+
+# Process a single cert.
+_docert() {
+	local identifier="$1"; shift
+
+	_verbose "checking certificate '%s'" "$identifier"
+
+	# uacme creates the cert name by stripping the extension from the
+	# CSR filename, so the basename has to match the identifier.
+	local dir="${_UACME_DIR}/${identifier}"
+	local keyfile="${dir}/${identifier}-key.pem"
+	local csrfile="${dir}/${identifier}.csr"
+	local certfile="${dir}/${identifier}-cert.pem"
+
+	# these can be overridden by args
+	local keytype=""
+	local altnames=""
+	local hooks=""
+	local domain=""
+	local challenge=""
+
+	# parse arguments for this cert
+	while ! [ -z "$1" ]; do
+		case "$1" in
+		type=rsa)
+			keytype=rsa
+			;;
+		type=ec)
+			keytype=ec
+			;;
+		type=*)
+			_error "%s: unknown key type: %s" \
+				"$identifier" "${1#type=*}"
+			return 1
+			;;
+		hook=*)
+			hooks="$hooks ${1#hook=*}"
+			;;
+		challenge=*)
+			challenge="${1#challenge=*}"
+			;;
+		*=*)
+			_error "%s: unknown option: %s" "$identifier" "$1"
+			return 1
+			;;
+		*.*)
+			altnames="$altnames $1"
+			# Take the domain from the first altname.
+			if [ -z "$domain" ]; then
+				domain="$1"
+			fi
+			;;
+		*)
+			_error "%s: unknown option: %s" "$identifier" "$1"
+			return 1
+			;;
+		esac
+		shift
+	done
+
+	# If no altnames were given, the identifier is the domain.
+	if [ -z "$domain" ]; then
+		domain="$identifier"
+	fi
+
+	# Default key type is ec.
+	if [ -z "$keytype" ]; then
+		keytype="ec"
+	fi
+
+	# Default challenge is http.
+	if [ -z "$challenge" ]; then
+		challenge="http"
+	fi
+
+	# make sure the challenge is valid.
+	challenge_path="$(_findchallenge "$identifier" "$challenge")"
+	if [ -z "$challenge_path" ]; then
+		return 1
+	fi
+
+	# make sure all the hook scripts are valid.  if the hook name
+	# begins with a '/' it's a full path, otherwise it's relative
+	# to ACME_HOOKDIR.
+	local _rhooks=""
+	for hook in $hooks; do
+		local _hookpath="$(_findhook "$identifier" "$hook")"
+		if [ -z "$_hookpath" ]; then
+			return 1
+		fi
+
+		_rhooks="$_rhooks $_hookpath"
+	done
+
+	mkdir -p -m0700 "$dir"
+
+	if ! _make_key "$keytype" "$keyfile"; then
+		_error "%s: could not create a new private key" "$identifier"
+		return 1
+	fi
+
+	if ! _make_csr "$csrfile" "$keyfile" "$domain" "$altnames"; then
+		_error "%s: could not create the certificate signing request" \
+			"$identifier"
+		return 1
+	fi
+
+	_uacme $_uacme_flags 		\
+		-h "$challenge_path"	\
+		 issue "$csrfile"
+	_ret=$?
+
+	# exit 1 means the cert wasn't reissued
+	if [ "$_ret" -eq 1 ]; then
+		return 0
+	fi
+
+	# exit 2 means an actual error
+	if [ "$_ret" -eq 2 ]; then
+		_error "%s: failed to issue certificate" "$identifier"
+		return 1
+	fi
+
+	# any other non-zero exit code is unexpected
+	if [ "$_ret" -ne 0 ]; then
+		_error "%s: unexpected exit code from uacme: %d" \
+			"$identifier" "$_ret"
+		return 1
+	fi
+
+	# otherwise, exit code is 0 which means we (re)issued the cert,
+	# so run the hooks.
+	for hook in $_rhooks; do
+		_verbose "running hook: %s" "$hook"
+		env	"LFACME_CONFDIR=${_CONFDIR}"		\
+			"LFACME_VERBOSE=${LFACME_VERBOSE}"	\
+			"LFACME_CERT=${identifier}"		\
+			"LFACME_KEYFILE=${keyfile}"		\
+			"LFACME_CERTFILE=${certfile}"		\
+			"$hook" newcert
+		if [ "$?" -ne 0 ]; then
+			_warn "%s: hook script '%s' failed" \
+				"$identifier" "$hook"
+		fi
+		# should we do anything if the hook failed?
+	done
+
+	return $?
+}
+
+cat "$_DOMAINS" \
+| egrep -v '^(#|[[:space:]]*$)' \
+| (
+	_default_args=""
+	_exit=0
+
+	while read identifier args; do
+		if [ "$identifier" = "*" ]; then
+			_default_args="$args"
+			continue
+		fi
+
+		if ! _docert "$identifier" $_default_args $args; then
+			_exit=1
+		fi
+	done
+
+	exit $_exit
+)
+
+exit $?
diff --git a/lfacme-setup.8 b/lfacme-setup.8
deleted file mode 100644
index f34e518..0000000
--- a/lfacme-setup.8
+++ /dev/null
@@ -1,45 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 3, 2025
-.Dt LFACME-SETUP 8
-.Os
-.Sh NAME
-.Nm lfacme-setup
-.Nd create a new ACME account
-.Sh SYNOPSIS
-.Nm
-.Op Fl vy
-.Op Fl c Ar confdir
-.Sh DESCRIPTION
-The
-.Nm
-utility will register a new account with the ACME provider configured in
-.Xr acme.conf 5 .
-If the provider requires accepting terms of service to create an account,
-the ToS URL will be printed and
-.Nm
-will prompt the user to accept them.
-.Pp
-The follow options are accepted:
-.Bl -tag -width indent
-.It Fl c Ar confdir
-Use
-.Ar confdir
-as the configuration directory instead of the default
-.Pa /usr/local/etc/lfacme .
-.It Fl v
-Produce more output when running.
-This also passes the
-.Fl v
-option to uacme.
-.It Fl y
-If the ACME provider requires accepting terms of service,
-accept the provided terms automatically.
-.El
-.Sh ENVIRONMENT
-Refer to
-.Xr lfacme 8
-for a list of environment variables which affect the operation of
-.Nm .
-.Sh SEE ALSO
-.Xr acme.conf 5 ,
-.Xr lfacme 7
diff --git a/lfacme-setup.8.in b/lfacme-setup.8.in
new file mode 100644
index 0000000..893c0b2
--- /dev/null
+++ b/lfacme-setup.8.in
@@ -0,0 +1,45 @@
+.\" This source code is released into the public domain.
+.Dd June 3, 2025
+.Dt LFACME-SETUP 8
+.Os
+.Sh NAME
+.Nm lfacme-setup
+.Nd create a new ACME account
+.Sh SYNOPSIS
+.Nm
+.Op Fl vy
+.Op Fl c Ar confdir
+.Sh DESCRIPTION
+The
+.Nm
+utility will register a new account with the ACME provider configured in
+.Xr acme.conf 5 .
+If the provider requires accepting terms of service to create an account,
+the ToS URL will be printed and
+.Nm
+will prompt the user to accept them.
+.Pp
+The follow options are accepted:
+.Bl -tag -width indent
+.It Fl c Ar confdir
+Use
+.Ar confdir
+as the configuration directory instead of the default
+.Pa __CONFDIR__ .
+.It Fl v
+Produce more output when running.
+This also passes the
+.Fl v
+option to uacme.
+.It Fl y
+If the ACME provider requires accepting terms of service,
+accept the provided terms automatically.
+.El
+.Sh ENVIRONMENT
+Refer to
+.Xr lfacme 8
+for a list of environment variables which affect the operation of
+.Nm .
+.Sh SEE ALSO
+.Xr acme.conf 5 ,
+.Xr lfacme 7
diff --git a/lfacme-setup.sh b/lfacme-setup.sh
deleted file mode 100644
index f690cba..0000000
--- a/lfacme-setup.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#! /bin/sh
-# This source code is released into the public domain.
-
-# Parse command-line arguments.
-args=$(getopt c:vy $*)
-if [ $? -ne 0 ]; then
-	exit 1
-fi
-set -- $args
-
-_uacme_flags=""
-
-while :; do
-	case "$1" in
-	-c)
-		_CONFDIR="$2"
-		shift; shift;;
-	-v)
-		LFACME_VERBOSE=1
-		shift;;
-	-y)
-		_uacme_flags="$_uacme_flags $1"
-		shift;;
-	--)
-		shift; break;;
-	esac
-done
-
-# Initialise.
-. /usr/local/share/lfacme/init.sh
-
-# Run uacme.
-mkdir -p "$_UACME_DIR"
-_uacme $_uacme_flags new
diff --git a/lfacme-setup.sh.in b/lfacme-setup.sh.in
new file mode 100644
index 0000000..4b60263
--- /dev/null
+++ b/lfacme-setup.sh.in
@@ -0,0 +1,34 @@
+#! /bin/sh
+# This source code is released into the public domain.
+
+# Parse command-line arguments.
+args=$(getopt c:vy $*)
+if [ $? -ne 0 ]; then
+	exit 1
+fi
+set -- $args
+
+_uacme_flags=""
+
+while :; do
+	case "$1" in
+	-c)
+		_CONFDIR="$2"
+		shift; shift;;
+	-v)
+		LFACME_VERBOSE=1
+		shift;;
+	-y)
+		_uacme_flags="$_uacme_flags $1"
+		shift;;
+	--)
+		shift; break;;
+	esac
+done
+
+# Initialise.
+. __LIBDIR__/init.sh
+
+# Run uacme.
+mkdir -p "$_UACME_DIR"
+_uacme $_uacme_flags new
diff --git a/lfacme.7 b/lfacme.7
deleted file mode 100644
index bed5a08..0000000
--- a/lfacme.7
+++ /dev/null
@@ -1,76 +0,0 @@
-.\" This source code is released into the public domain.
-.Dd June 4, 2025
-.Dt LFACME 7
-.Os
-.Sh NAME
-.Nm lfacme
-.Nd issue, renew and manage ACME certificates
-.Sh SYNOPSIS
-.Nm lfacme-setup
-.Op opts
-.Nm lfacme-renew
-.Op opts
-.Sh DESCRIPTION
-The
-.Nm
-software package supports management of TLS certificates using an ACME server.
-Certificates can be automatically issued and renewed, and a hook system allows
-software using those certificates to be automatically (re)configured.
-.Pp
-Prior to using
-.Nm ,
-two configuration files must be created:
-.Pa /usr/local/etc/lfacme/acme.conf
-and
-.Pa /usr/local/etc/lfacme/domains.conf .
-Samples of both files are provided in
-.Pa /usr/local/etc/lfacme .
-Refer to
-.Xr acme.conf 5
-and
-.Xr domains.conf 5
-for more detailed documentation on these files.
-.Pp
-To perform initial setup, run
-.Xr lfacme-setup 8 .
-This will register an account on the ACME server, and create any required
-local data.
-Running
-.Xr lfacme-setup 8
-will not issue any certificates.
-.Pp
-To issue or renew certificates, run
-.Xr lfacme-renew 8 .
-This will examine the certificates configured in
-.Xr domains.conf 5 ;
-new certificates will be issued, while existing certificates will be renewed
-if necessary.
-To ensure certificates are automatically renewed when required,
-.Xr lfacme-renew 8
-should be run regularly, e.g. using
-.Xr cron 8 .
-.Sh ENVIRONMENT
-The following environment variables affect the executation of the
-.Nm
-utilities:
-.Bl -tag -width LFACME_VERBOSE
-.It Ev LFACME_CONFDIR
-Override the default configuration directory.
-This is equivalent to specifying the
-.Fl c
-flag on the command line.
-.It Ev LFACME_VERBOSE
-If set to a non-empty string, run in verbose mode.
-This is equivalent to specifying the
-.Fl v
-flag on the command line.
-.El
-.Pp
-Additionally, any configuration settings described in
-.Xr acme.conf 5
-may also be set in the environment.
-.Sh SEE ALSO
-.Xr acme.conf 5 ,
-.Xr domains.conf 5 ,
-.Xr lfacme-renew 8 ,
-.Xr lfacme-setup 8
diff --git a/lfacme.7.in b/lfacme.7.in
new file mode 100644
index 0000000..3f3fa34
--- /dev/null
+++ b/lfacme.7.in
@@ -0,0 +1,76 @@
+.\" This source code is released into the public domain.
+.Dd June 4, 2025
+.Dt LFACME 7
+.Os
+.Sh NAME
+.Nm lfacme
+.Nd issue, renew and manage ACME certificates
+.Sh SYNOPSIS
+.Nm lfacme-setup
+.Op opts
+.Nm lfacme-renew
+.Op opts
+.Sh DESCRIPTION
+The
+.Nm
+software package supports management of TLS certificates using an ACME server.
+Certificates can be automatically issued and renewed, and a hook system allows
+software using those certificates to be automatically (re)configured.
+.Pp
+Prior to using
+.Nm ,
+two configuration files must be created:
+.Pa __CONFDIR__/acme.conf
+and
+.Pa __CONFDIR__/domains.conf .
+Samples of both files are provided in
+.Pa __CONFDIR__lfacme .
+Refer to
+.Xr acme.conf 5
+and
+.Xr domains.conf 5
+for more detailed documentation on these files.
+.Pp
+To perform initial setup, run
+.Xr lfacme-setup 8 .
+This will register an account on the ACME server, and create any required
+local data.
+Running
+.Xr lfacme-setup 8
+will not issue any certificates.
+.Pp
+To issue or renew certificates, run
+.Xr lfacme-renew 8 .
+This will examine the certificates configured in
+.Xr domains.conf 5 ;
+new certificates will be issued, while existing certificates will be renewed
+if necessary.
+To ensure certificates are automatically renewed when required,
+.Xr lfacme-renew 8
+should be run regularly, e.g. using
+.Xr cron 8 .
+.Sh ENVIRONMENT
+The following environment variables affect the executation of the
+.Nm
+utilities:
+.Bl -tag -width LFACME_VERBOSE
+.It Ev LFACME_CONFDIR
+Override the default configuration directory.
+This is equivalent to specifying the
+.Fl c
+flag on the command line.
+.It Ev LFACME_VERBOSE
+If set to a non-empty string, run in verbose mode.
+This is equivalent to specifying the
+.Fl v
+flag on the command line.
+.El
+.Pp
+Additionally, any configuration settings described in
+.Xr acme.conf 5
+may also be set in the environment.
+.Sh SEE ALSO
+.Xr acme.conf 5 ,
+.Xr domains.conf 5 ,
+.Xr lfacme-renew 8 ,
+.Xr lfacme-setup 8
-- 
cgit v1.2.3