feat: support storing certs from multiple providers

internal/storage/storage.go

···
 package storage
 
 import (
+	"crypto/sha256"
 	"crypto/x509"
+	"encoding/hex"
 	"encoding/pem"
 	"fmt"
 	"os"
···
 
 // Storage handles certificate and key storage
 type Storage struct {
-	basePath   string
-	certsDir   string
-	privateDir string
+	basePath     string
+	certsDir     string
+	privateDir   string
+	directoryURL string
 }
 
 // New creates a new Storage instance
···
 		certsDir:   filepath.Join(basePath, certsDir),
 		privateDir: filepath.Join(basePath, privateDir),
 	}
+
+	// Create directories
+	if err := os.MkdirAll(s.certsDir, 0755); err != nil {
+		return nil, fmt.Errorf("creating certs directory: %w", err)
+	}
+	if err := os.MkdirAll(s.privateDir, 0700); err != nil {
+		return nil, fmt.Errorf("creating private directory: %w", err)
+	}
+
+	return s, nil
+}
+
+// NewWithDirectory creates a new Storage instance with a specific ACME directory URL
+// This allows certificates from different CAs (staging/production) to coexist
+func NewWithDirectory(basePath, certsDir, privateDir, directoryURL string) (*Storage, error) {
+	s := &Storage{
+		basePath:     basePath,
+		directoryURL: directoryURL,
+	}
+
+	// Create subdirectory based on directory URL hash
+	dirHash := hashDirectoryURL(directoryURL)
+	s.certsDir = filepath.Join(basePath, certsDir, dirHash)
+	s.privateDir = filepath.Join(basePath, privateDir, dirHash)
 
 	// Create directories
 	if err := os.MkdirAll(s.certsDir, 0755); err != nil {
···
 
 	renewalTime := time.Now().Add(time.Duration(daysBeforeExpiry) * 24 * time.Hour)
 	return expiry.Before(renewalTime), nil
+}
+
+// DeleteCertificate deletes a certificate from disk
+func (s *Storage) DeleteCertificate(domains []string) error {
+	name := sanitizeDomainName(domains[0])
+	certPath := filepath.Join(s.certsDir, name+".crt")
+	return os.Remove(certPath)
+}
+
+// DeletePrivateKey deletes a private key from disk
+func (s *Storage) DeletePrivateKey(domains []string) error {
+	name := sanitizeDomainName(domains[0])
+	keyPath := filepath.Join(s.privateDir, name+".key")
+	return os.Remove(keyPath)
+}
+
+// hashDirectoryURL creates a short hash of the directory URL for file organization
+func hashDirectoryURL(url string) string {
+	hash := sha256.Sum256([]byte(url))
+	// Use first 8 characters of hex for readability
+	return hex.EncodeToString(hash[:])[:8]
 }
 
 // sanitizeDomainName converts a domain name to a safe filename

main.go

···
 	}
 	log.Printf("Loaded configuration from: %s", *configPath)
 
-	// Initialize storage
-	stor, err := storage.New(cfg.Storage.BasePath, cfg.Storage.CertsDir, cfg.Storage.PrivateDir)
+	// Get directory URL early so we can use it for storage
+	directoryURL := cfg.ACME.GetDirectoryURL()
+
+	// Initialize storage with directory URL to separate staging/production certs
+	stor, err := storage.NewWithDirectory(cfg.Storage.BasePath, cfg.Storage.CertsDir, cfg.Storage.PrivateDir, directoryURL)
 	if err != nil {
 		log.Fatalf("Failed to initialize storage: %v", err)
 	}
···
 
 	// Initialize ACME client
 	accountDir := filepath.Join(cfg.Storage.BasePath, cfg.Storage.AccountDir)
-	acmeClient, err := acme.NewClient(cfg.ACME.GetDirectoryURL(), cfg.ACME.Email, accountDir, cfg.ACME.AcceptTOS)
+	acmeClient, err := acme.NewClient(directoryURL, cfg.ACME.Email, accountDir, cfg.ACME.AcceptTOS)
 	if err != nil {
 		log.Fatalf("Failed to create ACME client: %v", err)
 	}