webserver: allow listening to multiple addresses.

(Useful when dual-stack IPv4/IPv6 is not supported.)  Also, change the
default to listen to a UNIX-domain socket </var/run/lacme.socket>.

Moreover temporary iptables rules are no longer installed.  Hosts
without a public HTTP daemon listening on port 80 need to set the
'listen' option to [::] and/or 0.0.0.0, and possibly set the 'iptables'
option to Yes.

1 files changed, 19 insertions, 19 deletions

diff --git a/lacme.md b/lacme.md
index aec2cd1..94b40cb 100644
--- a/lacme.md
+++ b/lacme.md
@@ -51,13 +51,12 @@ with its own executable:
  4. For certificate issuances (`new-cert` command), an optional
     webserver (specified with the *command* option of the [`[webserver]`
     section](#webserver-section) of the configuration file), which is
-    spawned by the “master” `lacme` process when no service is listening
-    on the HTTP port.  (The only challenge type currently supported by
-    `lacme` is `http-01`, which requires a webserver to answer
-    challenges.) That webserver only processes `GET` and `HEAD` requests
-    under the `/.well-known/acme-challenge/` URI.
-    By default some [`iptables`(8)] rules are automatically installed to
-    open the HTTP port, and removed afterwards.
+    spawned by the “master” `lacme`.  (The only challenge type currently
+    supported by `lacme` is `http-01`, which requires a webserver to
+    answer challenges.)  That webserver only processes `GET` and `HEAD`
+    requests under the `/.well-known/acme-challenge/` URI.
+    Moreover temporary [`iptables`(8)] rules can be automatically
+    installed to open the HTTP port.
 
 Commands
 ========
@@ -228,18 +227,19 @@ This section is used for configuring the [ACME] webserver.
 
 *listen*
 
-:   Specify the local address to listen on, in the form
-    `ADDRESS[:PORT]`.  If `ADDRESS` is enclosed with brackets ‘[’/‘]’
-    then it denotes an IPv6; an empty `ADDRESS` means `0.0.0.0`.
-    Default: `:80`.
+:   Comma- or space-separated list of addresses to listen on.  Valid
+    addresses are of the form `IPV4:PORT`, `[IPV6]:PORT` (where the
+    `:PORT` suffix is optional and defaults to the HTTP port 80), or an
+    absolute path of a UNIX-domain socket (created with mode `0666`).
+    Default: `/var/run/lacme.socket`.
 
 *challenge-directory*
 
-:   If a webserver is already running, specify a non-existent directory
-    under which the webserver is configured to serve `GET` requests for
-    challenge files under `/.well-known/acme-challenge/` (for each
-    virtual hosts requiring authorization) as static files.
-    Default: `/var/www/acme-challenge`.
+:   Specify a non-existent directory under which an external HTTP daemon
+    is configured to serve `GET` requests for challenge files under
+    `/.well-known/acme-challenge/` (for each virtual host requiring
+    authorization) as static files.
+    This option is required when *listen* is empty.
 
 *user*
 
@@ -263,10 +263,10 @@ This section is used for configuring the [ACME] webserver.
 
 *iptables*
 
-:   Whether to automatically install [`iptables`(8)] rules to open the
-    `ADDRESS[:PORT]` specified with *listen*.  Theses rules are
+:   Whether to automatically install temporary [`iptables`(8)] rules to
+    open the `ADDRESS[:PORT]` specified with *listen*.  The rules are
     automatically removed once `lacme` exits.
-    Default: `Yes`.
+    Default: `No`.
 
 `[accountd]` section
 ---------------------