{{define "content"}}
<div class="cols">
{{with .Data}}
{{$e := .Errors}}{{$f := .Form}}
<section>
<h2>Serving now</h2>
{{if .Has}}
<dl>
  <dt>Certificate for</dt><dd>{{.Cert.Subject}}</dd>
  <dt>Issued by</dt><dd>{{.Cert.Issuer}}{{if .Cert.SelfSigned}} <span class="bad">self-signed: browsers warn</span>{{end}}</dd>
  <dt>Valid until</dt><dd>{{.Cert.NotAfter.Format "2006-01-02"}}</dd>
  <dt>SHA-256</dt><dd><code>{{.Cert.Fingerprint}}</code></dd>
</dl>
{{else}}<p>No certificate yet; the web UI creates a self-signed one when it starts.</p>{{end}}
</section>
<form method="post" action="/certificate">
  <input type="hidden" name="csrf" value="{{$.CSRF}}">
  <fieldset>
    <legend>Let's Encrypt</legend>
    <label class="inline"><input type="checkbox" name="enabled" {{if $f.Enabled}}checked{{end}}> Get a certificate for the web UI and renew it</label>
    <div>
    <label>DNS account <select name="provider"><option value=""></option>
      {{range .Providers}}<option value="{{.Name}}" {{if eq .Name $f.Provider}}selected{{end}}>{{.Name}} ({{.Type}})</option>{{end}}
    </select></label>
    <label>Contact e-mail <input name="email" value="{{$f.Email}}" size="26" spellcheck="false" placeholder="you@example.org"></label>
    </div>
    {{range $k := list "provider" "email"}}{{with index $e $k}}<p class="field-error">{{$k}}: {{.}}</p>{{end}}{{end}}
    <p class="hint">The account must be able to change the DNS records of the names: Let's Encrypt is shown it by a TXT record, so no port
       needs to be open to the internet. Accounts are kept on the <a href="/dnsproviders">DNS providers</a> page (cloudflare, desec,
       digitalocean, duckdns and hetzner work here).{{if not .Providers}} <strong>There is none yet.</strong>{{end}}</p>
    <label>Names, one per line; the first is the certificate's name <textarea name="domains" rows="4" cols="40" spellcheck="false">{{$f.Domains}}</textarea></label>
    {{with index $e "domains"}}<p class="field-error">{{.}}</p>{{end}}
    <p class="hint">A wildcard like <code>*.home.example.org</code> works. The names should lead to the router (see DNS) so the browser reaches it by name.</p>
    <label class="inline"><input type="checkbox" name="staging" {{if $f.Staging}}checked{{end}}> Test first with the staging service (its certificates are not trusted by browsers); uncheck for the real one</label>
    <label class="inline"><input type="checkbox" name="agree" {{if $f.Agree}}checked{{end}}> I accept the <a href="https://letsencrypt.org/repository/">Let's Encrypt subscriber agreement</a></label>
    {{with index $e "agree"}}<p class="field-error">{{.}}</p>{{end}}
  </fieldset>
  <button>Save</button>
</form>
<details{{if .Failed}} open{{end}}>
  <summary>Issuing and renewal log{{if .Failed}} (the last run failed){{end}}</summary>
  {{if .Status}}<p class="muted">{{.Status}}</p>{{if .Log}}<pre class="log">{{.Log}}</pre>{{end}}
  {{else}}<p class="muted">Nothing yet. After you save and apply, the router orders the certificate (a minute or two); renewals follow 30 days before it expires and need no restart.</p>{{end}}
</details>
{{end}}
</div>
{{end}}