--- a/src/luan/host/Https.luan	Tue Dec 16 17:18:37 2025 -0800
+++ b/src/luan/host/Https.luan	Tue Dec 16 17:28:57 2025 -0800
@@ -71,35 +71,7 @@
 <%
 end
 
-function Https.update(domain,site_dir,luanhost_dir)
-	local files = get_files(domain,site_dir)
-	if files.nginx_file.exists() then
-		-- sys_logger.info("update "..domain)
-		local nginx = ` nginx_ssl_conf(domain,files,luanhost_dir) `
-		files.nginx_file.write(nginx)
-	end
-end
-function Https.set_https(is_https)
-	if Http.did_init() then
-		logger.error(new_error("set_https called outside of init.luan"))
-		return
-	end
-	local domain = Http.domain
-	local site_dir = uri("site:").parent()
-	local luanhost_dir = uri("file:.")
-
-	-- use for testing, so as to not hit rate limits
-	-- on the real letsencrypt servers
-	local dry_run = false
-
-	if not try_synchronized( function()
-		do_set_https(is_https,domain,site_dir,luanhost_dir,dry_run)
-	end, domain..".lock", 0 )() then
-		logger.info("set_https already running for "..domain..", skipping")
-	end
-end
-
-function Issue_cert(domain, site_dir, luanhost_dir, dry_run, files)
+local function Issue_cert(domain, site_dir, luanhost_dir, dry_run, files)
 	local luanhost_dir_str = luanhost_dir.canonical().to_string()
 	local csr_file_str = files.csr_file_str.canonical().to_string()
 
@@ -152,15 +124,16 @@
 end
 
 
-function Https.renew_ssl(renewal_period,domain,site_dir,luanhost_dir,dry_run)
-	files.csr_file.exists() or error "no CSR file, assuming local https cert"
-	if time_now() - files.csr_file.last_modified() < renewal_period then
-		Issue_cert(domain, site_dir, luanhost_dir, dry_run, files)
-		return
+
+function Https.update(domain,site_dir,luanhost_dir)
+	local files = get_files(domain,site_dir)
+	if files.nginx_file.exists() then
+		-- sys_logger.info("update "..domain)
+		local nginx = ` nginx_ssl_conf(domain,files,luanhost_dir) `
+		files.nginx_file.write(nginx)
 	end
 end
 
-
 local function do_set_https(is_https,domain,site_dir,luanhost_dir,dry_run)
 	local files = get_files(domain,site_dir)
 
@@ -259,5 +232,32 @@
 end
 Https.do_set_https = do_set_https	-- for testing
 
+function Https.set_https(is_https)
+	if Http.did_init() then
+		logger.error(new_error("set_https called outside of init.luan"))
+		return
+	end
+	local domain = Http.domain
+	local site_dir = uri("site:").parent()
+	local luanhost_dir = uri("file:.")
+
+	-- use for testing, so as to not hit rate limits
+	-- on the real letsencrypt servers
+	local dry_run = false
+
+	if not try_synchronized( function()
+		do_set_https(is_https,domain,site_dir,luanhost_dir,dry_run)
+	end, domain..".lock", 0 )() then
+		logger.info("set_https already running for "..domain..", skipping")
+	end
+end
+
+function Https.renew_ssl(files,renewal_period,domain,site_dir,luanhost_dir,dry_run)
+	files.csr_file.exists() or error "no CSR file, assuming local https cert"
+	if time_now() - files.csr_file.last_modified() < renewal_period then
+		Issue_cert(domain, site_dir, luanhost_dir, dry_run, files)
+		return
+	end
+end
 
 return Https