pub(crate) fn node_tls(rest: &[&str]) -> !Expand description
choir node tls — obtain the certificate and wire up its renewal.
The only command in this binary that expects to be run as root, and the only one that writes outside the state directory. Both facts are checked before anything happens rather than discovered halfway through, because a half-done certificate step leaves a marker naming files that are not there — and the node reads that marker at every start.