Merge remote-tracking branch 'origin/master' into ap2_merge_master

2026-07-28 00:24:35 +02:00 · 2020-01-06 17:17:31 +02:00
parent 70be256c66 fda655370a
commit 0f5bda4ff9
824 changed files with 6382 additions and 9081 deletions
@@ -1,7 +1,8 @@
 include LICENSE.txt
 include README.rst
-recursive-include docs *
-recursive-include certbot_apache/tests/testdata *
-include certbot_apache/centos-options-ssl-apache.conf
-include certbot_apache/options-ssl-apache.conf
-recursive-include certbot_apache/augeas_lens *.aug
+recursive-include tests *
+include certbot_apache/_internal/centos-options-ssl-apache.conf
+include certbot_apache/_internal/options-ssl-apache.conf
+recursive-include certbot_apache/_internal/augeas_lens *.aug
+global-exclude __pycache__
+global-exclude *.py[cod]
@@ -0,0 +1 @@
+"""Certbot Apache plugin."""
@@ -1,5 +1,6 @@
 """Apache Configurator."""
 # pylint: disable=too-many-lines
+from collections import defaultdict
 import copy
 import fnmatch
 import logging
@@ -7,36 +8,34 @@ import re
 import socket
 import time

-from collections import defaultdict
-
 import pkg_resources
 import six
-
 import zope.component
 import zope.interface

 from acme import challenges
-from acme.magic_typing import DefaultDict, Dict, List, Set, Union  # pylint: disable=unused-import, no-name-in-module
-
+from acme.magic_typing import DefaultDict  # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import Dict  # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import Union  # pylint: disable=unused-import, no-name-in-module
 from certbot import errors
 from certbot import interfaces
 from certbot import util
-
 from certbot.achallenges import KeyAuthorizationAnnotatedChallenge  # pylint: disable=unused-import
 from certbot.compat import filesystem
 from certbot.compat import os
 from certbot.plugins import common
-from certbot.plugins.util import path_surgery
 from certbot.plugins.enhancements import AutoHSTSEnhancement
-
-from certbot_apache import apache_util
-from certbot_apache import assertions
-from certbot_apache import constants
-from certbot_apache import display_ops
-from certbot_apache import dualparser
-from certbot_apache import http_01
-from certbot_apache import obj
-from certbot_apache import parser
+from certbot.plugins.util import path_surgery
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import assertions
+from certbot_apache._internal import constants
+from certbot_apache._internal import display_ops
+from certbot_apache._internal import dualparser
+from certbot_apache._internal import http_01
+from certbot_apache._internal import obj
+from certbot_apache._internal import parser

 logger = logging.getLogger(__name__)

@@ -73,18 +72,17 @@ logger = logging.getLogger(__name__)
@zope.interface.implementer(interfaces.IAuthenticator, interfaces.IInstaller)
@zope.interface.provider(interfaces.IPluginFactory)
 class ApacheConfigurator(common.Installer):
-    # pylint: disable=too-many-instance-attributes,too-many-public-methods
    """Apache configurator.

    :ivar config: Configuration.
    :type config: :class:`~certbot.interfaces.IConfig`

    :ivar parser: Handles low level parsing
-    :type parser: :class:`~certbot_apache.parser`
+    :type parser: :class:`~certbot_apache._internal.parser`

    :ivar tup version: version of Apache
    :ivar list vhosts: All vhosts found in the configuration
-        (:class:`list` of :class:`~certbot_apache.obj.VirtualHost`)
+        (:class:`list` of :class:`~certbot_apache._internal.obj.VirtualHost`)

    :ivar dict assoc: Mapping between domains and vhosts

@@ -113,7 +111,7 @@ class ApacheConfigurator(common.Installer):
        handle_sites=False,
        challenge_location="/etc/apache2",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", "options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "options-ssl-apache.conf"))
    )

    def option(self, key):
@@ -176,8 +174,6 @@ class ApacheConfigurator(common.Installer):
                 "(Only Ubuntu/Debian currently)")
        add("ctl", default=DEFAULTS["ctl"],
            help="Full path to Apache control script")
-        util.add_deprecated_argument(
-            add, argument_name="init-script", nargs=1)

    def __init__(self, *args, **kwargs):
        """Initialize an Apache Configurator.
@@ -426,7 +422,7 @@ class ApacheConfigurator(common.Installer):
            counterpart, should one get created

        :returns: List of VirtualHosts or None
-        :rtype: `list` of :class:`~certbot_apache.obj.VirtualHost`
+        :rtype: `list` of :class:`~certbot_apache._internal.obj.VirtualHost`
        """

        if self._wildcard_domain(domain):
@@ -485,7 +481,7 @@ class ApacheConfigurator(common.Installer):
                    filtered_vhosts[name] = vhost

        # Only unique VHost objects
-        dialog_input = set([vhost for vhost in filtered_vhosts.values()])
+        dialog_input = set(filtered_vhosts.values())

        # Ask the user which of names to enable, expect list of names back
        dialog_output = display_ops.select_vhost_multiple(list(dialog_input))
@@ -601,7 +597,7 @@ class ApacheConfigurator(common.Installer):
            counterpart, should one get created

        :returns: vhost associated with name
-        :rtype: :class:`~certbot_apache.obj.VirtualHost`
+        :rtype: :class:`~certbot_apache._internal.obj.VirtualHost`

        :raises .errors.PluginError: If no vhost is available or chosen

@@ -636,9 +632,9 @@ class ApacheConfigurator(common.Installer):
                "in the Apache config.",
                target_name)
            raise errors.PluginError("No vhost selected")
-        elif temp:
+        if temp:
            return vhost
-        elif not vhost.ssl:
+        if not vhost.ssl:
            addrs = self._get_proposed_addrs(vhost, "443")
            # TODO: Conflicts is too conservative
            if not any(vhost.enabled and vhost.conflicts(addrs) for
@@ -704,7 +700,7 @@ class ApacheConfigurator(common.Installer):

        :param str target_name: domain handled by the desired vhost
        :param vhosts: vhosts to consider
-        :type vhosts: `collections.Iterable` of :class:`~certbot_apache.obj.VirtualHost`
+        :type vhosts: `collections.Iterable` of :class:`~certbot_apache._internal.obj.VirtualHost`
        :param bool filter_defaults: whether a vhost with a _default_
            addr is acceptable

@@ -846,7 +842,7 @@ class ApacheConfigurator(common.Installer):
        """Helper function for get_virtual_hosts().

        :param host: In progress vhost whose names will be added
-        :type host: :class:`~certbot_apache.obj.VirtualHost`
+        :type host: :class:`~certbot_apache._internal.obj.VirtualHost`

        """

@@ -865,7 +861,7 @@ class ApacheConfigurator(common.Installer):
        :param str path: Augeas path to virtual host

        :returns: newly created vhost
-        :rtype: :class:`~certbot_apache.obj.VirtualHost`
+        :rtype: :class:`~certbot_apache._internal.obj.VirtualHost`

        """
        addrs = set()
@@ -929,7 +925,7 @@ class ApacheConfigurator(common.Installer):
    def get_virtual_hosts_v1(self):
        """Returns list of virtual hosts found in the Apache configuration.

-        :returns: List of :class:`~certbot_apache.obj.VirtualHost`
+        :returns: List of :class:`~certbot_apache._internal.obj.VirtualHost`
            objects found in configuration
        :rtype: list

@@ -1060,7 +1056,7 @@ class ApacheConfigurator(common.Installer):
        now NameVirtualHosts. If version is earlier than 2.4, check if addr
        has a NameVirtualHost directive in the Apache config

-        :param certbot_apache.obj.Addr target_addr: vhost address
+        :param certbot_apache._internal.obj.Addr target_addr: vhost address

        :returns: Success
        :rtype: bool
@@ -1078,19 +1074,18 @@ class ApacheConfigurator(common.Installer):
        """Adds NameVirtualHost directive for given address.

        :param addr: Address that will be added as NameVirtualHost directive
-        :type addr: :class:`~certbot_apache.obj.Addr`
+        :type addr: :class:`~certbot_apache._internal.obj.Addr`

        """

        loc = parser.get_aug_path(self.parser.loc["name"])
        if addr.get_port() == "443":
-            path = self.parser.add_dir_to_ifmodssl(
+            self.parser.add_dir_to_ifmodssl(
                loc, "NameVirtualHost", [str(addr)])
        else:
-            path = self.parser.add_dir(loc, "NameVirtualHost", [str(addr)])
+            self.parser.add_dir(loc, "NameVirtualHost", [str(addr)])

-        msg = ("Setting %s to be NameBasedVirtualHost\n"
-               "\tDirective added to %s\n" % (addr, path))
+        msg = "Setting {0} to be NameBasedVirtualHost\n".format(addr)
        logger.debug(msg)
        self.save_notes += msg

@@ -1247,7 +1242,7 @@ class ApacheConfigurator(common.Installer):
            if "ssl_module" not in self.parser.modules:
                self.enable_mod("ssl", temp=temp)

-    def make_vhost_ssl(self, nonssl_vhost):  # pylint: disable=too-many-locals
+    def make_vhost_ssl(self, nonssl_vhost):
        """Makes an ssl_vhost version of a nonssl_vhost.

        Duplicates vhost and adds default ssl options
@@ -1257,10 +1252,10 @@ class ApacheConfigurator(common.Installer):
        .. note:: This function saves the configuration

        :param nonssl_vhost: Valid VH that doesn't have SSLEngine on
-        :type nonssl_vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type nonssl_vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :returns: SSL vhost
-        :rtype: :class:`~certbot_apache.obj.VirtualHost`
+        :rtype: :class:`~certbot_apache._internal.obj.VirtualHost`

        :raises .errors.PluginError: If more than one virtual host is in
            the file or if plugin is unable to write/read vhost files.
@@ -1498,12 +1493,9 @@ class ApacheConfigurator(common.Installer):
                        result.append(comment)
                        sift = True

-                    result.append('\n'.join(
-                        ['# ' + l for l in chunk]))
-                    continue
+                    result.append('\n'.join(['# ' + l for l in chunk]))
                else:
                    result.append('\n'.join(chunk))
-                    continue
        return result, sift

    def _get_vhost_block(self, vhost):
@@ -1631,7 +1623,7 @@ class ApacheConfigurator(common.Installer):
        https://httpd.apache.org/docs/2.2/mod/core.html#namevirtualhost

        :param vhost: New virtual host that was recently created.
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        """
        need_to_save = False
@@ -1666,7 +1658,7 @@ class ApacheConfigurator(common.Installer):
        :param str id_str: Id string for matching

        :returns: The matched VirtualHost or None
-        :rtype: :class:`~certbot_apache.obj.VirtualHost` or None
+        :rtype: :class:`~certbot_apache._internal.obj.VirtualHost` or None

        :raises .errors.PluginError: If no VirtualHost is found
        """
@@ -1683,7 +1675,7 @@ class ApacheConfigurator(common.Installer):
        used for keeping track of VirtualHost directive over time.

        :param vhost: Virtual host to add the id
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :returns: The unique ID or None
        :rtype: str or None
@@ -1705,7 +1697,7 @@ class ApacheConfigurator(common.Installer):
        If ID already exists, returns that instead.

        :param vhost: Virtual host to add or find the id
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :returns: The unique ID for vhost
        :rtype: str or None
@@ -1743,9 +1735,9 @@ class ApacheConfigurator(common.Installer):

        :param str domain: domain to enhance
        :param str enhancement: enhancement type defined in
-            :const:`~certbot.constants.ENHANCEMENTS`
+            :const:`~certbot.plugins.enhancements.ENHANCEMENTS`
        :param options: options for the enhancement
-            See :const:`~certbot.constants.ENHANCEMENTS`
+            See :const:`~certbot.plugins.enhancements.ENHANCEMENTS`
            documentation for appropriate parameter.

        :raises .errors.PluginError: If Enhancement is not supported, or if
@@ -1783,7 +1775,7 @@ class ApacheConfigurator(common.Installer):
        """Increase the AutoHSTS max-age value

        :param vhost: Virtual host object to modify
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :param str id_str: The unique ID string of VirtualHost

@@ -1867,13 +1859,13 @@ class ApacheConfigurator(common.Installer):
        .. note:: This function saves the configuration

        :param ssl_vhost: Destination of traffic, an ssl enabled vhost
-        :type ssl_vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type ssl_vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :param unused_options: Not currently used
        :type unused_options: Not Available

        :returns: Success, general_vhost (HTTP vhost)
-        :rtype: (bool, :class:`~certbot_apache.obj.VirtualHost`)
+        :rtype: (bool, :class:`~certbot_apache._internal.obj.VirtualHost`)

        """
        min_apache_ver = (2, 3, 3)
@@ -1923,14 +1915,14 @@ class ApacheConfigurator(common.Installer):
        .. note:: This function saves the configuration

        :param ssl_vhost: Destination of traffic, an ssl enabled vhost
-        :type ssl_vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type ssl_vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :param header_substring: string that uniquely identifies a header.
                e.g: Strict-Transport-Security, Upgrade-Insecure-Requests.
        :type str

        :returns: Success, general_vhost (HTTP vhost)
-        :rtype: (bool, :class:`~certbot_apache.obj.VirtualHost`)
+        :rtype: (bool, :class:`~certbot_apache._internal.obj.VirtualHost`)

        :raises .errors.PluginError: If no viable HTTP host can be created or
            set with header header_substring.
@@ -1958,7 +1950,7 @@ class ApacheConfigurator(common.Installer):
        contains the string header_substring.

        :param ssl_vhost: vhost to check
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :param header_substring: string that uniquely identifies a header.
                e.g: Strict-Transport-Security, Upgrade-Insecure-Requests.
@@ -1995,7 +1987,7 @@ class ApacheConfigurator(common.Installer):
        .. note:: This function saves the configuration

        :param ssl_vhost: Destination of traffic, an ssl enabled vhost
-        :type ssl_vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type ssl_vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :param unused_options: Not currently used
        :type unused_options: Not Available
@@ -2080,7 +2072,7 @@ class ApacheConfigurator(common.Installer):
        delete certbot's old rewrite rules and set the new one instead.

        :param vhost: vhost to check
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :raises errors.PluginEnhancementAlreadyPresent: When the exact
                certbot redirection WriteRule exists in virtual host.
@@ -2122,7 +2114,7 @@ class ApacheConfigurator(common.Installer):
        """Checks if there exists a RewriteRule directive in vhost

        :param vhost: vhost to check
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :returns: True if a RewriteRule directive exists.
        :rtype: bool
@@ -2136,7 +2128,7 @@ class ApacheConfigurator(common.Installer):
        """Checks if a RewriteEngine directive is on

        :param vhost: vhost to check
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        """
        rewrite_engine_path_list = self.parser.find_dir("RewriteEngine", "on",
@@ -2153,10 +2145,10 @@ class ApacheConfigurator(common.Installer):
        """Creates an http_vhost specifically to redirect for the ssl_vhost.

        :param ssl_vhost: ssl vhost
-        :type ssl_vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type ssl_vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :returns: tuple of the form
-            (`success`, :class:`~certbot_apache.obj.VirtualHost`)
+            (`success`, :class:`~certbot_apache._internal.obj.VirtualHost`)
        :rtype: tuple

        """
@@ -2282,7 +2274,7 @@ class ApacheConfigurator(common.Installer):
                  of this method where available.

        :param vhost: vhost to enable
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :raises .errors.NotSupportedError: If filesystem layout is not
            supported.
@@ -2476,7 +2468,7 @@ class ApacheConfigurator(common.Installer):
        Enable the AutoHSTS enhancement for defined domains

        :param _unused_lineage: Certificate lineage object, unused
-        :type _unused_lineage: certbot.storage.RenewableCert
+        :type _unused_lineage: certbot._internal.storage.RenewableCert

        :param domains: List of domains in certificate to enhance
        :type domains: str
@@ -2519,7 +2511,7 @@ class ApacheConfigurator(common.Installer):
        """Do the initial AutoHSTS deployment to a vhost

        :param ssl_vhost: The VirtualHost object to deploy the AutoHSTS
-        :type ssl_vhost: :class:`~certbot_apache.obj.VirtualHost` or None
+        :type ssl_vhost: :class:`~certbot_apache._internal.obj.VirtualHost` or None

        :raises errors.PluginEnhancementAlreadyPresent: When already enhanced

@@ -2601,7 +2593,7 @@ class ApacheConfigurator(common.Installer):
        and changes the HSTS max-age to a high value.

        :param lineage: Certificate lineage object
-        :type lineage: certbot.storage.RenewableCert
+        :type lineage: certbot._internal.storage.RenewableCert
        """
        self._autohsts_fetch_state()
        if not self._autohsts:
@@ -2646,4 +2638,4 @@ class ApacheConfigurator(common.Installer):
        self._autohsts_save_state()


-AutoHSTSEnhancement.register(ApacheConfigurator)  # pylint: disable=no-member
+AutoHSTSEnhancement.register(ApacheConfigurator)
@@ -1,6 +1,7 @@
 """Apache plugin constants."""
 import pkg_resources

+from certbot.compat import os

 MOD_SSL_CONF_DEST = "options-ssl-apache.conf"
 """Name of the mod_ssl config file as saved in `IConfig.config_dir`."""
@@ -27,7 +28,7 @@ ALL_SSL_OPTIONS_HASHES = [
 """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""

 AUGEAS_LENS_DIR = pkg_resources.resource_filename(
-    "certbot_apache", "augeas_lens")
+    "certbot_apache", os.path.join("_internal", "augeas_lens"))
 """Path to the Augeas lens directory"""

 REWRITE_HTTPS_ARGS = [
@@ -3,10 +3,10 @@ import logging

 import zope.component

-import certbot.display.util as display_util
 from certbot import errors
 from certbot import interfaces
 from certbot.compat import os
+import certbot.display.util as display_util

 logger = logging.getLogger(__name__)

@@ -77,7 +77,7 @@ def _vhost_menu(domain, vhosts):

    if free_chars < 2:
        logger.debug("Display size is too small for "
-                     "certbot_apache.display_ops._vhost_menu()")
+                     "certbot_apache._internal.display_ops._vhost_menu()")
        # This runs the edge off the screen, but it doesn't cause an "error"
        filename_size = 1
        disp_name_size = 1
@@ -4,18 +4,18 @@
 from distutils.version import LooseVersion  # pylint: disable=no-name-in-module,import-error

 from certbot import util
-
-from certbot_apache import configurator
-from certbot_apache import override_arch
-from certbot_apache import override_fedora
-from certbot_apache import override_darwin
-from certbot_apache import override_debian
-from certbot_apache import override_centos
-from certbot_apache import override_gentoo
-from certbot_apache import override_suse
+from certbot_apache._internal import configurator
+from certbot_apache._internal import override_arch
+from certbot_apache._internal import override_centos
+from certbot_apache._internal import override_darwin
+from certbot_apache._internal import override_debian
+from certbot_apache._internal import override_fedora
+from certbot_apache._internal import override_gentoo
+from certbot_apache._internal import override_suse

 OVERRIDE_CLASSES = {
    "arch": override_arch.ArchConfigurator,
+    "cloudlinux": override_centos.CentOSConfigurator,
    "darwin": override_darwin.DarwinConfigurator,
    "debian": override_debian.DebianConfigurator,
    "ubuntu": override_debian.DebianConfigurator,
@@ -23,7 +23,9 @@ OVERRIDE_CLASSES = {
    "centos linux": override_centos.CentOSConfigurator,
    "fedora_old": override_centos.CentOSConfigurator,
    "fedora": override_fedora.FedoraConfigurator,
+    "linuxmint": override_debian.DebianConfigurator,
    "ol": override_centos.CentOSConfigurator,
+    "oracle": override_centos.CentOSConfigurator,
    "redhatenterpriseserver": override_centos.CentOSConfigurator,
    "red hat enterprise linux server": override_centos.CentOSConfigurator,
    "rhel": override_centos.CentOSConfigurator,
@@ -32,6 +34,7 @@ OVERRIDE_CLASSES = {
    "gentoo base system": override_gentoo.GentooConfigurator,
    "opensuse": override_suse.OpenSUSEConfigurator,
    "suse": override_suse.OpenSUSEConfigurator,
+    "sles": override_suse.OpenSUSEConfigurator,
    "scientific": override_centos.CentOSConfigurator,
    "scientific linux": override_centos.CentOSConfigurator,
 }
@@ -1,20 +1,19 @@
 """A class that performs HTTP-01 challenges for Apache"""
 import logging

-from acme.magic_typing import List, Set  # pylint: disable=unused-import, no-name-in-module
-
+from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
 from certbot import errors
-from certbot.compat import os
 from certbot.compat import filesystem
+from certbot.compat import os
 from certbot.plugins import common
-
-from certbot_apache.obj import VirtualHost  # pylint: disable=unused-import
-from certbot_apache.parser import get_aug_path
+from certbot_apache._internal.obj import VirtualHost  # pylint: disable=unused-import
+from certbot_apache._internal.parser import get_aug_path

 logger = logging.getLogger(__name__)


-class ApacheHttp01(common.TLSSNI01):
+class ApacheHttp01(common.ChallengePerformer):
    """Class that performs HTTP-01 challenges within the Apache configurator."""

    CONFIG_TEMPLATE22_PRE = """\
@@ -195,8 +194,8 @@ class ApacheHttp01(common.TLSSNI01):

        if vhost not in self.moded_vhosts:
            logger.debug(
-                "Adding a temporary challenge validation Include for name: %s " +
-                "in: %s", vhost.name, vhost.filep)
+                "Adding a temporary challenge validation Include for name: %s in: %s",
+                vhost.name, vhost.filep)
            self.configurator.parser.add_dir_beginning(
                vhost.path, "Include", self.challenge_conf_pre)
            self.configurator.parser.add_dir(
@@ -1,7 +1,7 @@
 """Module contains classes used by the Apache Configurator."""
 import re

-from acme.magic_typing import Set # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
 from certbot.plugins import common


@@ -24,7 +24,7 @@ class Addr(common.Addr):
        return not self.__eq__(other)

    def __repr__(self):
-        return "certbot_apache.obj.Addr(" + repr(self.tup) + ")"
+        return "certbot_apache._internal.obj.Addr(" + repr(self.tup) + ")"

    def __hash__(self):  # pylint: disable=useless-super-delegation
        # Python 3 requires explicit overridden for __hash__ if __eq__ or
@@ -98,7 +98,7 @@ class Addr(common.Addr):
        return self.get_addr_obj(port)


-class VirtualHost(object):  # pylint: disable=too-few-public-methods
+class VirtualHost(object):
    """Represents an Apache Virtualhost.

    :ivar str filep: file path of VH
@@ -126,7 +126,6 @@ class VirtualHost(object):  # pylint: disable=too-few-public-methods
    def __init__(self, filep, path, addrs, ssl, enabled, name=None,
                 aliases=None, modmacro=False, ancestor=None, node=None):

-        # pylint: disable=too-many-arguments
        """Initialize a VH."""
        self.filep = filep
        self.path = path
@@ -1,11 +1,11 @@
 """ Distribution specific override class for Arch Linux """
 import pkg_resources
-
 import zope.interface

 from certbot import interfaces
+from certbot.compat import os
+from certbot_apache._internal import configurator

-from certbot_apache import configurator

@zope.interface.provider(interfaces.IPluginFactory)
 class ArchConfigurator(configurator.ApacheConfigurator):
@@ -27,5 +27,5 @@ class ArchConfigurator(configurator.ApacheConfigurator):
        handle_sites=False,
        challenge_location="/etc/httpd/conf",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", "options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "options-ssl-apache.conf"))
    )
@@ -4,17 +4,15 @@ import logging
 import pkg_resources
 import zope.interface

+from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
 from certbot import errors
 from certbot import interfaces
 from certbot import util
+from certbot.compat import os
 from certbot.errors import MisconfigurationError
-
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
-
-from certbot_apache import apache_util
-from certbot_apache import configurator
-from certbot_apache import parser
-
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import configurator
+from certbot_apache._internal import parser

 logger = logging.getLogger(__name__)

@@ -40,7 +38,7 @@ class CentOSConfigurator(configurator.ApacheConfigurator):
        handle_sites=False,
        challenge_location="/etc/httpd/conf.d",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", "centos-options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "centos-options-ssl-apache.conf"))
    )

    def config_test(self):
@@ -1,11 +1,11 @@
 """ Distribution specific override class for macOS """
 import pkg_resources
-
 import zope.interface

 from certbot import interfaces
+from certbot.compat import os
+from certbot_apache._internal import configurator

-from certbot_apache import configurator

@zope.interface.provider(interfaces.IPluginFactory)
 class DarwinConfigurator(configurator.ApacheConfigurator):
@@ -27,5 +27,5 @@ class DarwinConfigurator(configurator.ApacheConfigurator):
        handle_sites=False,
        challenge_location="/etc/apache2/other",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", "options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "options-ssl-apache.conf"))
    )
@@ -9,9 +9,8 @@ from certbot import interfaces
 from certbot import util
 from certbot.compat import filesystem
 from certbot.compat import os
-
-from certbot_apache import apache_util
-from certbot_apache import configurator
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import configurator

 logger = logging.getLogger(__name__)

@@ -36,7 +35,7 @@ class DebianConfigurator(configurator.ApacheConfigurator):
        handle_sites=True,
        challenge_location="/etc/apache2",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", "options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "options-ssl-apache.conf"))
    )

    def enable_site(self, vhost):
@@ -46,7 +45,7 @@ class DebianConfigurator(configurator.ApacheConfigurator):
                  modules are enabled appropriately.

        :param vhost: vhost to enable
-        :type vhost: :class:`~certbot_apache.obj.VirtualHost`
+        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`

        :raises .errors.NotSupportedError: If filesystem layout is not
            supported.
@@ -71,15 +70,14 @@ class DebianConfigurator(configurator.ApacheConfigurator):
                # Already in shape
                vhost.enabled = True
                return None
-            else:
-                logger.warning(
-                    "Could not symlink %s to %s, got error: %s", enabled_path,
-                    vhost.filep, err.strerror)
-                errstring = ("Encountered error while trying to enable a " +
-                             "newly created VirtualHost located at {0} by " +
-                             "linking to it from {1}")
-                raise errors.NotSupportedError(errstring.format(vhost.filep,
-                                                                enabled_path))
+            logger.warning(
+                "Could not symlink %s to %s, got error: %s", enabled_path,
+                vhost.filep, err.strerror)
+            errstring = ("Encountered error while trying to enable a " +
+                         "newly created VirtualHost located at {0} by " +
+                         "linking to it from {1}")
+            raise errors.NotSupportedError(errstring.format(vhost.filep,
+                                                            enabled_path))
        vhost.enabled = True
        logger.info("Enabling available site: %s", vhost.filep)
        self.save_notes += "Enabled site %s\n" % vhost.filep
@@ -5,10 +5,10 @@ import zope.interface
 from certbot import errors
 from certbot import interfaces
 from certbot import util
-
-from certbot_apache import apache_util
-from certbot_apache import configurator
-from certbot_apache import parser
+from certbot.compat import os
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import configurator
+from certbot_apache._internal import parser


@zope.interface.provider(interfaces.IPluginFactory)
@@ -33,7 +33,7 @@ class FedoraConfigurator(configurator.ApacheConfigurator):
        challenge_location="/etc/httpd/conf.d",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
            # TODO: eventually newest version of Fedora will need their own config
-            "certbot_apache", "centos-options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "centos-options-ssl-apache.conf"))
    )

    def config_test(self):
@@ -1,13 +1,13 @@
 """ Distribution specific override class for Gentoo Linux """
 import pkg_resources
-
 import zope.interface

 from certbot import interfaces
+from certbot.compat import os
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import configurator
+from certbot_apache._internal import parser

-from certbot_apache import apache_util
-from certbot_apache import configurator
-from certbot_apache import parser

@zope.interface.provider(interfaces.IPluginFactory)
 class GentooConfigurator(configurator.ApacheConfigurator):
@@ -30,7 +30,7 @@ class GentooConfigurator(configurator.ApacheConfigurator):
        handle_sites=False,
        challenge_location="/etc/apache2/vhosts.d",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", "options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "options-ssl-apache.conf"))
    )

    def _prepare_options(self):
@@ -1,11 +1,11 @@
 """ Distribution specific override class for OpenSUSE """
 import pkg_resources
-
 import zope.interface

 from certbot import interfaces
+from certbot.compat import os
+from certbot_apache._internal import configurator

-from certbot_apache import configurator

@zope.interface.provider(interfaces.IPluginFactory)
 class OpenSUSEConfigurator(configurator.ApacheConfigurator):
@@ -27,5 +27,5 @@ class OpenSUSEConfigurator(configurator.ApacheConfigurator):
        handle_sites=False,
        challenge_location="/etc/apache2/vhosts.d",
        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", "options-ssl-apache.conf")
+            "certbot_apache", os.path.join("_internal", "options-ssl-apache.conf"))
    )
@@ -7,19 +7,18 @@ import sys

 import six

-from acme.magic_typing import Dict, List, Set  # pylint: disable=unused-import, no-name-in-module
-
+from acme.magic_typing import Dict  # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
+from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
 from certbot import errors
 from certbot.compat import os
-
-from certbot_apache import apache_util
-from certbot_apache import constants
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import constants

 logger = logging.getLogger(__name__)


 class ApacheParser(object):
-    # pylint: disable=too-many-public-methods
    """Class handles the fine details of parsing the Apache Configuration.

    .. todo:: Make parsing general... remove sites-available etc...
@@ -285,8 +284,8 @@ class ApacheParser(object):
                    mods.add(mod_name)
                    mods.add(os.path.basename(mod_filename)[:-2] + "c")
                else:
-                    logger.debug("Could not read LoadModule directive from " +
-                                 "Augeas path: %s", match_name[6:])
+                    logger.debug("Could not read LoadModule directive from Augeas path: %s",
+                                 match_name[6:])
        self.modules.update(mods)

    def update_runtime_variables(self):
@@ -561,7 +560,7 @@ class ApacheParser(object):
        # https://httpd.apache.org/docs/2.4/mod/core.html#include
        for match in matches:
            dir_ = self.aug.get(match).lower()
-            if dir_ == "include" or dir_ == "includeoptional":
+            if dir_ in ("include", "includeoptional"):
                ordered_matches.extend(self.find_dir(
                    directive, arg,
                    self._get_include_path(self.get_arg(match + "/arg")),
@@ -601,8 +600,7 @@ class ApacheParser(object):
        # e.g. strip now, not later
        if not value:
            return None
-        else:
-            value = value.strip("'\"")
+        value = value.strip("'\"")

        variables = ApacheParser.arg_var_interpreter.findall(value)

@@ -1 +0,0 @@
-"""Certbot Apache Tests"""
@@ -1 +0,0 @@
-/_build/
@@ -1,192 +0,0 @@
-# Makefile for Sphinx documentation
-#
-
-# You can set these variables from the command line.
-SPHINXOPTS    =
-SPHINXBUILD   = sphinx-build
-PAPER         =
-BUILDDIR      = _build
-
-# User-friendly check for sphinx-build
-ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
-$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
-endif
-
-# Internal variables.
-PAPEROPT_a4     = -D latex_paper_size=a4
-PAPEROPT_letter = -D latex_paper_size=letter
-ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
-# the i18n builder cannot share the environment and doctrees with the others
-I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
-
-.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest coverage gettext
-
-help:
-	@echo "Please use \`make <target>' where <target> is one of"
-	@echo "  html       to make standalone HTML files"
-	@echo "  dirhtml    to make HTML files named index.html in directories"
-	@echo "  singlehtml to make a single large HTML file"
-	@echo "  pickle     to make pickle files"
-	@echo "  json       to make JSON files"
-	@echo "  htmlhelp   to make HTML files and a HTML help project"
-	@echo "  qthelp     to make HTML files and a qthelp project"
-	@echo "  applehelp  to make an Apple Help Book"
-	@echo "  devhelp    to make HTML files and a Devhelp project"
-	@echo "  epub       to make an epub"
-	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
-	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
-	@echo "  latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
-	@echo "  text       to make text files"
-	@echo "  man        to make manual pages"
-	@echo "  texinfo    to make Texinfo files"
-	@echo "  info       to make Texinfo files and run them through makeinfo"
-	@echo "  gettext    to make PO message catalogs"
-	@echo "  changes    to make an overview of all changed/added/deprecated items"
-	@echo "  xml        to make Docutils-native XML files"
-	@echo "  pseudoxml  to make pseudoxml-XML files for display purposes"
-	@echo "  linkcheck  to check all external links for integrity"
-	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
-	@echo "  coverage   to run coverage check of the documentation (if enabled)"
-
-clean:
-	rm -rf $(BUILDDIR)/*
-
-html:
-	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
-	@echo
-	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
-
-dirhtml:
-	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
-	@echo
-	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
-
-singlehtml:
-	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
-	@echo
-	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
-
-pickle:
-	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
-	@echo
-	@echo "Build finished; now you can process the pickle files."
-
-json:
-	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
-	@echo
-	@echo "Build finished; now you can process the JSON files."
-
-htmlhelp:
-	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
-	@echo
-	@echo "Build finished; now you can run HTML Help Workshop with the" \
-	      ".hhp project file in $(BUILDDIR)/htmlhelp."
-
-qthelp:
-	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
-	@echo
-	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
-	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
-	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/certbot-apache.qhcp"
-	@echo "To view the help file:"
-	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/certbot-apache.qhc"
-
-applehelp:
-	$(SPHINXBUILD) -b applehelp $(ALLSPHINXOPTS) $(BUILDDIR)/applehelp
-	@echo
-	@echo "Build finished. The help book is in $(BUILDDIR)/applehelp."
-	@echo "N.B. You won't be able to view it unless you put it in" \
-	      "~/Library/Documentation/Help or install it in your application" \
-	      "bundle."
-
-devhelp:
-	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
-	@echo
-	@echo "Build finished."
-	@echo "To view the help file:"
-	@echo "# mkdir -p $$HOME/.local/share/devhelp/certbot-apache"
-	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/certbot-apache"
-	@echo "# devhelp"
-
-epub:
-	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
-	@echo
-	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
-
-latex:
-	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
-	@echo
-	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
-	@echo "Run \`make' in that directory to run these through (pdf)latex" \
-	      "(use \`make latexpdf' here to do that automatically)."
-
-latexpdf:
-	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
-	@echo "Running LaTeX files through pdflatex..."
-	$(MAKE) -C $(BUILDDIR)/latex all-pdf
-	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
-
-latexpdfja:
-	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
-	@echo "Running LaTeX files through platex and dvipdfmx..."
-	$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
-	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
-
-text:
-	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
-	@echo
-	@echo "Build finished. The text files are in $(BUILDDIR)/text."
-
-man:
-	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
-	@echo
-	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
-
-texinfo:
-	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
-	@echo
-	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
-	@echo "Run \`make' in that directory to run these through makeinfo" \
-	      "(use \`make info' here to do that automatically)."
-
-info:
-	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
-	@echo "Running Texinfo files through makeinfo..."
-	make -C $(BUILDDIR)/texinfo info
-	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
-
-gettext:
-	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
-	@echo
-	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
-
-changes:
-	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
-	@echo
-	@echo "The overview file is in $(BUILDDIR)/changes."
-
-linkcheck:
-	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
-	@echo
-	@echo "Link check complete; look for any errors in the above output " \
-	      "or in $(BUILDDIR)/linkcheck/output.txt."
-
-doctest:
-	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
-	@echo "Testing of doctests in the sources finished, look at the " \
-	      "results in $(BUILDDIR)/doctest/output.txt."
-
-coverage:
-	$(SPHINXBUILD) -b coverage $(ALLSPHINXOPTS) $(BUILDDIR)/coverage
-	@echo "Testing of coverage in the sources finished, look at the " \
-	      "results in $(BUILDDIR)/coverage/python.txt."
-
-xml:
-	$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
-	@echo
-	@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
-
-pseudoxml:
-	$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
-	@echo
-	@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."
@@ -1,8 +0,0 @@
-=================
-API Documentation
-=================
-
-.. toctree::
-   :glob:
-
-   api/**
@@ -1,5 +0,0 @@
-:mod:`certbot_apache.augeas_configurator`
---------------------------------------------
-
-.. automodule:: certbot_apache.augeas_configurator
-   :members:
@@ -1,5 +0,0 @@
-:mod:`certbot_apache.configurator`
--------------------------------------
-
-.. automodule:: certbot_apache.configurator
-   :members:
@@ -1,5 +0,0 @@
-:mod:`certbot_apache.display_ops`
-------------------------------------
-
-.. automodule:: certbot_apache.display_ops
-   :members:
@@ -1,5 +0,0 @@
-:mod:`certbot_apache.obj`
-----------------------------
-
-.. automodule:: certbot_apache.obj
-   :members:
@@ -1,5 +0,0 @@
-:mod:`certbot_apache.parser`
--------------------------------
-
-.. automodule:: certbot_apache.parser
-   :members:
@@ -1,5 +0,0 @@
-:mod:`certbot_apache.tls_sni_01`
------------------------------------
-
-.. automodule:: certbot_apache.tls_sni_01
-   :members:
@@ -1,318 +0,0 @@
-# -*- coding: utf-8 -*-
-#
-# certbot-apache documentation build configuration file, created by
-# sphinx-quickstart on Sun Oct 18 13:39:26 2015.
-#
-# This file is execfile()d with the current directory set to its
-# containing dir.
-#
-# Note that not all possible configuration values are present in this
-# autogenerated file.
-#
-# All configuration values have a default; values that are commented out
-# serve to show the default.
-
-import sys
-from certbot.compat import os
-import shlex
-
-import mock
-
-
-# http://docs.readthedocs.org/en/latest/faq.html#i-get-import-errors-on-libraries-that-depend-on-c-modules
-# c.f. #262
-sys.modules.update(
-    (mod_name, mock.MagicMock()) for mod_name in ['augeas'])
-
-here = os.path.abspath(os.path.dirname(__file__))
-
-# If extensions (or modules to document with autodoc) are in another directory,
-# add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
-sys.path.insert(0, os.path.abspath(os.path.join(here, '..')))
-
-# -- General configuration ------------------------------------------------
-
-# If your documentation needs a minimal Sphinx version, state it here.
-needs_sphinx = '1.0'
-
-# Add any Sphinx extension module names here, as strings. They can be
-# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
-# ones.
-extensions = [
-    'sphinx.ext.autodoc',
-    'sphinx.ext.intersphinx',
-    'sphinx.ext.todo',
-    'sphinx.ext.coverage',
-    'sphinx.ext.viewcode',
-]
-
-autodoc_member_order = 'bysource'
-autodoc_default_flags = ['show-inheritance', 'private-members']
-
-# Add any paths that contain templates here, relative to this directory.
-templates_path = ['_templates']
-
-# The suffix(es) of source filenames.
-# You can specify multiple suffix as a list of string:
-# source_suffix = ['.rst', '.md']
-source_suffix = '.rst'
-
-# The encoding of source files.
-#source_encoding = 'utf-8-sig'
-
-# The master toctree document.
-master_doc = 'index'
-
-# General information about the project.
-project = u'certbot-apache'
-copyright = u'2014-2015, Let\'s Encrypt Project'
-author = u'Certbot Project'
-
-# The version info for the project you're documenting, acts as replacement for
-# |version| and |release|, also used in various other places throughout the
-# built documents.
-#
-# The short X.Y version.
-version = '0'
-# The full version, including alpha/beta/rc tags.
-release = '0'
-
-# The language for content autogenerated by Sphinx. Refer to documentation
-# for a list of supported languages.
-#
-# This is also used if you do content translation via gettext catalogs.
-# Usually you set "language" from the command line for these cases.
-language = 'en'
-
-# There are two options for replacing |today|: either, you set today to some
-# non-false value, then it is used:
-#today = ''
-# Else, today_fmt is used as the format for a strftime call.
-#today_fmt = '%B %d, %Y'
-
-# List of patterns, relative to source directory, that match files and
-# directories to ignore when looking for source files.
-exclude_patterns = ['_build']
-
-# The reST default role (used for this markup: `text`) to use for all
-# documents.
-default_role = 'py:obj'
-
-# If true, '()' will be appended to :func: etc. cross-reference text.
-#add_function_parentheses = True
-
-# If true, the current module name will be prepended to all description
-# unit titles (such as .. function::).
-#add_module_names = True
-
-# If true, sectionauthor and moduleauthor directives will be shown in the
-# output. They are ignored by default.
-#show_authors = False
-
-# The name of the Pygments (syntax highlighting) style to use.
-pygments_style = 'sphinx'
-
-# A list of ignored prefixes for module index sorting.
-#modindex_common_prefix = []
-
-# If true, keep warnings as "system message" paragraphs in the built documents.
-#keep_warnings = False
-
-# If true, `todo` and `todoList` produce output, else they produce nothing.
-todo_include_todos = True
-
-
-# -- Options for HTML output ----------------------------------------------
-
-# The theme to use for HTML and HTML Help pages.  See the documentation for
-# a list of builtin themes.
-
-# http://docs.readthedocs.org/en/latest/theme.html#how-do-i-use-this-locally-and-on-read-the-docs
-# on_rtd is whether we are on readthedocs.org
-on_rtd = os.environ.get('READTHEDOCS', None) == 'True'
-if not on_rtd:  # only import and set the theme if we're building docs locally
-    import sphinx_rtd_theme
-    html_theme = 'sphinx_rtd_theme'
-    html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
-# otherwise, readthedocs.org uses their theme by default, so no need to specify it
-
-# Theme options are theme-specific and customize the look and feel of a theme
-# further.  For a list of options available for each theme, see the
-# documentation.
-#html_theme_options = {}
-
-# Add any paths that contain custom themes here, relative to this directory.
-#html_theme_path = []
-
-# The name for this set of Sphinx documents.  If None, it defaults to
-# "<project> v<release> documentation".
-#html_title = None
-
-# A shorter title for the navigation bar.  Default is the same as html_title.
-#html_short_title = None
-
-# The name of an image file (relative to this directory) to place at the top
-# of the sidebar.
-#html_logo = None
-
-# The name of an image file (within the static path) to use as favicon of the
-# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
-# pixels large.
-#html_favicon = None
-
-# Add any paths that contain custom static files (such as style sheets) here,
-# relative to this directory. They are copied after the builtin static files,
-# so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
-
-# Add any extra paths that contain custom files (such as robots.txt or
-# .htaccess) here, relative to this directory. These files are copied
-# directly to the root of the documentation.
-#html_extra_path = []
-
-# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
-# using the given strftime format.
-#html_last_updated_fmt = '%b %d, %Y'
-
-# If true, SmartyPants will be used to convert quotes and dashes to
-# typographically correct entities.
-#html_use_smartypants = True
-
-# Custom sidebar templates, maps document names to template names.
-#html_sidebars = {}
-
-# Additional templates that should be rendered to pages, maps page names to
-# template names.
-#html_additional_pages = {}
-
-# If false, no module index is generated.
-#html_domain_indices = True
-
-# If false, no index is generated.
-#html_use_index = True
-
-# If true, the index is split into individual pages for each letter.
-#html_split_index = False
-
-# If true, links to the reST sources are added to the pages.
-#html_show_sourcelink = True
-
-# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
-#html_show_sphinx = True
-
-# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
-#html_show_copyright = True
-
-# If true, an OpenSearch description file will be output, and all pages will
-# contain a <link> tag referring to it.  The value of this option must be the
-# base URL from which the finished HTML is served.
-#html_use_opensearch = ''
-
-# This is the file name suffix for HTML files (e.g. ".xhtml").
-#html_file_suffix = None
-
-# Language to be used for generating the HTML full-text search index.
-# Sphinx supports the following languages:
-#   'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja'
-#   'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr'
-#html_search_language = 'en'
-
-# A dictionary with options for the search language support, empty by default.
-# Now only 'ja' uses this config value
-#html_search_options = {'type': 'default'}
-
-# The name of a javascript file (relative to the configuration directory) that
-# implements a search results scorer. If empty, the default will be used.
-#html_search_scorer = 'scorer.js'
-
-# Output file base name for HTML help builder.
-htmlhelp_basename = 'certbot-apachedoc'
-
-# -- Options for LaTeX output ---------------------------------------------
-
-latex_elements = {
-    # The paper size ('letterpaper' or 'a4paper').
-    #'papersize': 'letterpaper',
-
-    # The font size ('10pt', '11pt' or '12pt').
-    #'pointsize': '10pt',
-
-    # Additional stuff for the LaTeX preamble.
-    #'preamble': '',
-
-    # Latex figure (float) alignment
-    #'figure_align': 'htbp',
-}
-
-# Grouping the document tree into LaTeX files. List of tuples
-# (source start file, target name, title,
-#  author, documentclass [howto, manual, or own class]).
-latex_documents = [
-    (master_doc, 'certbot-apache.tex', u'certbot-apache Documentation',
-     u'Certbot Project', 'manual'),
-]
-
-# The name of an image file (relative to this directory) to place at the top of
-# the title page.
-#latex_logo = None
-
-# For "manual" documents, if this is true, then toplevel headings are parts,
-# not chapters.
-#latex_use_parts = False
-
-# If true, show page references after internal links.
-#latex_show_pagerefs = False
-
-# If true, show URL addresses after external links.
-#latex_show_urls = False
-
-# Documents to append as an appendix to all manuals.
-#latex_appendices = []
-
-# If false, no module index is generated.
-#latex_domain_indices = True
-
-
-# -- Options for manual page output ---------------------------------------
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    (master_doc, 'certbot-apache', u'certbot-apache Documentation',
-     [author], 1)
-]
-
-# If true, show URL addresses after external links.
-#man_show_urls = False
-
-
-# -- Options for Texinfo output -------------------------------------------
-
-# Grouping the document tree into Texinfo files. List of tuples
-# (source start file, target name, title, author,
-#  dir menu entry, description, category)
-texinfo_documents = [
-    (master_doc, 'certbot-apache', u'certbot-apache Documentation',
-     author, 'certbot-apache', 'One line description of project.',
-     'Miscellaneous'),
-]
-
-# Documents to append as an appendix to all manuals.
-#texinfo_appendices = []
-
-# If false, no module index is generated.
-#texinfo_domain_indices = True
-
-# How to display URL addresses: 'footnote', 'no', or 'inline'.
-#texinfo_show_urls = 'footnote'
-
-# If true, do not generate a @detailmenu in the "Top" node's menu.
-#texinfo_no_detailmenu = False
-
-
-intersphinx_mapping = {
-    'python': ('https://docs.python.org/', None),
-    'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
-    'certbot': ('https://certbot.eff.org/docs/', None),
-}
@@ -1,31 +0,0 @@
-.. certbot-apache documentation master file, created by
-   sphinx-quickstart on Sun Oct 18 13:39:26 2015.
-   You can adapt this file completely to your liking, but it should at least
-   contain the root `toctree` directive.
-
-Welcome to certbot-apache's documentation!
-==============================================
-
-Contents:
-
-.. toctree::
-   :maxdepth: 2
-
-
-.. toctree::
-   :maxdepth: 1
-
-   api
-
-
-.. automodule:: certbot_apache
-   :members:
-
-
-Indices and tables
-==================
-
-* :ref:`genindex`
-* :ref:`modindex`
-* :ref:`search`
-
@@ -1,263 +0,0 @@
-@ECHO OFF
-
-REM Command file for Sphinx documentation
-
-if "%SPHINXBUILD%" == "" (
-	set SPHINXBUILD=sphinx-build
-)
-set BUILDDIR=_build
-set ALLSPHINXOPTS=-d %BUILDDIR%/doctrees %SPHINXOPTS% .
-set I18NSPHINXOPTS=%SPHINXOPTS% .
-if NOT "%PAPER%" == "" (
-	set ALLSPHINXOPTS=-D latex_paper_size=%PAPER% %ALLSPHINXOPTS%
-	set I18NSPHINXOPTS=-D latex_paper_size=%PAPER% %I18NSPHINXOPTS%
-)
-
-if "%1" == "" goto help
-
-if "%1" == "help" (
-	:help
-	echo.Please use `make ^<target^>` where ^<target^> is one of
-	echo.  html       to make standalone HTML files
-	echo.  dirhtml    to make HTML files named index.html in directories
-	echo.  singlehtml to make a single large HTML file
-	echo.  pickle     to make pickle files
-	echo.  json       to make JSON files
-	echo.  htmlhelp   to make HTML files and a HTML help project
-	echo.  qthelp     to make HTML files and a qthelp project
-	echo.  devhelp    to make HTML files and a Devhelp project
-	echo.  epub       to make an epub
-	echo.  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter
-	echo.  text       to make text files
-	echo.  man        to make manual pages
-	echo.  texinfo    to make Texinfo files
-	echo.  gettext    to make PO message catalogs
-	echo.  changes    to make an overview over all changed/added/deprecated items
-	echo.  xml        to make Docutils-native XML files
-	echo.  pseudoxml  to make pseudoxml-XML files for display purposes
-	echo.  linkcheck  to check all external links for integrity
-	echo.  doctest    to run all doctests embedded in the documentation if enabled
-	echo.  coverage   to run coverage check of the documentation if enabled
-	goto end
-)
-
-if "%1" == "clean" (
-	for /d %%i in (%BUILDDIR%\*) do rmdir /q /s %%i
-	del /q /s %BUILDDIR%\*
-	goto end
-)
-
-
-REM Check if sphinx-build is available and fallback to Python version if any
-%SPHINXBUILD% 2> nul
-if errorlevel 9009 goto sphinx_python
-goto sphinx_ok
-
-:sphinx_python
-
-set SPHINXBUILD=python -m sphinx.__init__
-%SPHINXBUILD% 2> nul
-if errorlevel 9009 (
-	echo.
-	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
-	echo.installed, then set the SPHINXBUILD environment variable to point
-	echo.to the full path of the 'sphinx-build' executable. Alternatively you
-	echo.may add the Sphinx directory to PATH.
-	echo.
-	echo.If you don't have Sphinx installed, grab it from
-	echo.http://sphinx-doc.org/
-	exit /b 1
-)
-
-:sphinx_ok
-
-
-if "%1" == "html" (
-	%SPHINXBUILD% -b html %ALLSPHINXOPTS% %BUILDDIR%/html
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The HTML pages are in %BUILDDIR%/html.
-	goto end
-)
-
-if "%1" == "dirhtml" (
-	%SPHINXBUILD% -b dirhtml %ALLSPHINXOPTS% %BUILDDIR%/dirhtml
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The HTML pages are in %BUILDDIR%/dirhtml.
-	goto end
-)
-
-if "%1" == "singlehtml" (
-	%SPHINXBUILD% -b singlehtml %ALLSPHINXOPTS% %BUILDDIR%/singlehtml
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The HTML pages are in %BUILDDIR%/singlehtml.
-	goto end
-)
-
-if "%1" == "pickle" (
-	%SPHINXBUILD% -b pickle %ALLSPHINXOPTS% %BUILDDIR%/pickle
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished; now you can process the pickle files.
-	goto end
-)
-
-if "%1" == "json" (
-	%SPHINXBUILD% -b json %ALLSPHINXOPTS% %BUILDDIR%/json
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished; now you can process the JSON files.
-	goto end
-)
-
-if "%1" == "htmlhelp" (
-	%SPHINXBUILD% -b htmlhelp %ALLSPHINXOPTS% %BUILDDIR%/htmlhelp
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished; now you can run HTML Help Workshop with the ^
-.hhp project file in %BUILDDIR%/htmlhelp.
-	goto end
-)
-
-if "%1" == "qthelp" (
-	%SPHINXBUILD% -b qthelp %ALLSPHINXOPTS% %BUILDDIR%/qthelp
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished; now you can run "qcollectiongenerator" with the ^
-.qhcp project file in %BUILDDIR%/qthelp, like this:
-	echo.^> qcollectiongenerator %BUILDDIR%\qthelp\certbot-apache.qhcp
-	echo.To view the help file:
-	echo.^> assistant -collectionFile %BUILDDIR%\qthelp\certbot-apache.ghc
-	goto end
-)
-
-if "%1" == "devhelp" (
-	%SPHINXBUILD% -b devhelp %ALLSPHINXOPTS% %BUILDDIR%/devhelp
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished.
-	goto end
-)
-
-if "%1" == "epub" (
-	%SPHINXBUILD% -b epub %ALLSPHINXOPTS% %BUILDDIR%/epub
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The epub file is in %BUILDDIR%/epub.
-	goto end
-)
-
-if "%1" == "latex" (
-	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished; the LaTeX files are in %BUILDDIR%/latex.
-	goto end
-)
-
-if "%1" == "latexpdf" (
-	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
-	cd %BUILDDIR%/latex
-	make all-pdf
-	cd %~dp0
-	echo.
-	echo.Build finished; the PDF files are in %BUILDDIR%/latex.
-	goto end
-)
-
-if "%1" == "latexpdfja" (
-	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
-	cd %BUILDDIR%/latex
-	make all-pdf-ja
-	cd %~dp0
-	echo.
-	echo.Build finished; the PDF files are in %BUILDDIR%/latex.
-	goto end
-)
-
-if "%1" == "text" (
-	%SPHINXBUILD% -b text %ALLSPHINXOPTS% %BUILDDIR%/text
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The text files are in %BUILDDIR%/text.
-	goto end
-)
-
-if "%1" == "man" (
-	%SPHINXBUILD% -b man %ALLSPHINXOPTS% %BUILDDIR%/man
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The manual pages are in %BUILDDIR%/man.
-	goto end
-)
-
-if "%1" == "texinfo" (
-	%SPHINXBUILD% -b texinfo %ALLSPHINXOPTS% %BUILDDIR%/texinfo
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The Texinfo files are in %BUILDDIR%/texinfo.
-	goto end
-)
-
-if "%1" == "gettext" (
-	%SPHINXBUILD% -b gettext %I18NSPHINXOPTS% %BUILDDIR%/locale
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The message catalogs are in %BUILDDIR%/locale.
-	goto end
-)
-
-if "%1" == "changes" (
-	%SPHINXBUILD% -b changes %ALLSPHINXOPTS% %BUILDDIR%/changes
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.The overview file is in %BUILDDIR%/changes.
-	goto end
-)
-
-if "%1" == "linkcheck" (
-	%SPHINXBUILD% -b linkcheck %ALLSPHINXOPTS% %BUILDDIR%/linkcheck
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Link check complete; look for any errors in the above output ^
-or in %BUILDDIR%/linkcheck/output.txt.
-	goto end
-)
-
-if "%1" == "doctest" (
-	%SPHINXBUILD% -b doctest %ALLSPHINXOPTS% %BUILDDIR%/doctest
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Testing of doctests in the sources finished, look at the ^
-results in %BUILDDIR%/doctest/output.txt.
-	goto end
-)
-
-if "%1" == "coverage" (
-	%SPHINXBUILD% -b coverage %ALLSPHINXOPTS% %BUILDDIR%/coverage
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Testing of coverage in the sources finished, look at the ^
-results in %BUILDDIR%/coverage/python.txt.
-	goto end
-)
-
-if "%1" == "xml" (
-	%SPHINXBUILD% -b xml %ALLSPHINXOPTS% %BUILDDIR%/xml
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The XML files are in %BUILDDIR%/xml.
-	goto end
-)
-
-if "%1" == "pseudoxml" (
-	%SPHINXBUILD% -b pseudoxml %ALLSPHINXOPTS% %BUILDDIR%/pseudoxml
-	if errorlevel 1 exit /b 1
-	echo.
-	echo.Build finished. The pseudo-XML files are in %BUILDDIR%/pseudoxml.
-	goto end
-)
-
-:end
@@ -1,3 +1,3 @@
 # Remember to update setup.py to match the package versions below.
 acme[dev]==0.29.0
-certbot[dev]==0.39.0
+-e certbot[dev]
@@ -1,12 +0,0 @@
-# readthedocs.org gives no way to change the install command to "pip
-# install -e .[docs]" (that would in turn install documentation
-# dependencies), but it allows to specify a requirements.txt file at
-# https://readthedocs.org/dashboard/letsencrypt/advanced/ (c.f. #259)
-
-# Although ReadTheDocs certainly doesn't need to install the project
-# in --editable mode (-e), just "pip install .[docs]" does not work as
-# expected and "pip install -e .[docs]" must be used instead
-
-e acme
-e .
-e certbot-apache[docs]
@@ -1,16 +1,16 @@
-from setuptools import setup
-from setuptools import find_packages
-from setuptools.command.test import test as TestCommand
 import sys

+from setuptools import find_packages
+from setuptools import setup
+from setuptools.command.test import test as TestCommand

-version = '0.40.0.dev0'
+version = '1.1.0.dev0'

 # Remember to update local-oldest-requirements.txt when changing the minimum
 # acme/certbot version.
 install_requires = [
    'acme>=0.29.0',
-    'certbot>=0.39.0',
+    'certbot>=1.0.0.dev0',
    'mock',
    'python-augeas',
    'setuptools',
@@ -18,11 +18,6 @@ install_requires = [
    'zope.interface',
 ]

-docs_extras = [
-    'Sphinx>=1.0',  # autodoc_member_order = 'bysource', autodoc_default_flags
-    'sphinx_rtd_theme',
-]
-

 class PyTest(TestCommand):
    user_options = []
@@ -74,12 +69,9 @@ setup(
    packages=find_packages(),
    include_package_data=True,
    install_requires=install_requires,
-    extras_require={
-        'docs': docs_extras,
-    },
    entry_points={
        'certbot.plugins': [
-            'apache = certbot_apache.entrypoint:ENTRYPOINT',
+            'apache = certbot_apache._internal.entrypoint:ENTRYPOINT',
        ],
    },
    test_suite='certbot_apache',
@@ -1,14 +1,14 @@
-# pylint: disable=too-many-public-methods,too-many-lines
-"""Test for certbot_apache.configurator AutoHSTS functionality"""
+# pylint: disable=too-many-lines
+"""Test for certbot_apache._internal.configurator AutoHSTS functionality"""
 import re
 import unittest
+
 import mock
-# six is used in mock.patch()
-import six  # pylint: disable=unused-import
+import six  # pylint: disable=unused-import  # six is used in mock.patch()

 from certbot import errors
-from certbot_apache import constants
-from certbot_apache.tests import util
+from certbot_apache._internal import constants
+import util


 class AutoHSTSTest(util.ApacheTest):
@@ -39,24 +39,24 @@ class AutoHSTSTest(util.ApacheTest):
                        head.replace("arg[3]", "arg[4]"))
        return None  # pragma: no cover

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.enable_mod")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.enable_mod")
    def test_autohsts_enable_headers_mod(self, mock_enable, _restart):
        self.config.parser.modules.discard("headers_module")
        self.config.parser.modules.discard("mod_header.c")
        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
        self.assertTrue(mock_enable.called)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
    def test_autohsts_deploy_already_exists(self, _restart):
        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
        self.assertRaises(errors.PluginEnhancementAlreadyPresent,
                          self.config.enable_autohsts,
                          mock.MagicMock(), ["ocspvhost.com"])

-    @mock.patch("certbot_apache.constants.AUTOHSTS_FREQ", 0)
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.prepare")
+    @mock.patch("certbot_apache._internal.constants.AUTOHSTS_FREQ", 0)
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.prepare")
    def test_autohsts_increase(self, mock_prepare, _mock_restart):
        self.config._prepared = False
        maxage = "\"max-age={0}\""
@@ -74,8 +74,8 @@ class AutoHSTSTest(util.ApacheTest):
                          inc_val)
        self.assertTrue(mock_prepare.called)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._autohsts_increase")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator._autohsts_increase")
    def test_autohsts_increase_noop(self, mock_increase, _restart):
        maxage = "\"max-age={0}\""
        initial_val = maxage.format(constants.AUTOHSTS_STEPS[0])
@@ -89,8 +89,8 @@ class AutoHSTSTest(util.ApacheTest):
        self.assertFalse(mock_increase.called)


-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.constants.AUTOHSTS_FREQ", 0)
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.constants.AUTOHSTS_FREQ", 0)
    def test_autohsts_increase_no_header(self, _restart):
        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
        # Remove the header
@@ -102,8 +102,8 @@ class AutoHSTSTest(util.ApacheTest):
                          self.config.update_autohsts,
                          mock.MagicMock())

-    @mock.patch("certbot_apache.constants.AUTOHSTS_FREQ", 0)
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.constants.AUTOHSTS_FREQ", 0)
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
    def test_autohsts_increase_and_make_permanent(self, _mock_restart):
        maxage = "\"max-age={0}\""
        max_val = maxage.format(constants.AUTOHSTS_PERMANENT)
@@ -141,18 +141,18 @@ class AutoHSTSTest(util.ApacheTest):
        # Make sure that the execution does not continue when no entries in store
        self.assertFalse(self.config.storage.put.called)

-    @mock.patch("certbot_apache.display_ops.select_vhost")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost")
    def test_autohsts_no_ssl_vhost(self, mock_select):
        mock_select.return_value = self.vh_truth[0]
-        with mock.patch("certbot_apache.configurator.logger.warning") as mock_log:
+        with mock.patch("certbot_apache._internal.configurator.logger.warning") as mock_log:
            self.assertRaises(errors.PluginError,
                              self.config.enable_autohsts,
                              mock.MagicMock(), "invalid.example.com")
            self.assertTrue(
                "Certbot was not able to find SSL" in mock_log.call_args[0][0])

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.add_vhost_id")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.add_vhost_id")
    def test_autohsts_dont_enhance_twice(self, mock_id, _restart):
        mock_id.return_value = "1234567"
        self.config.enable_autohsts(mock.MagicMock(),
@@ -177,7 +177,7 @@ class AutoHSTSTest(util.ApacheTest):
        self.config._autohsts_fetch_state()
        self.config._autohsts["orphan_id"] = {"laststep": 999, "timestamp": 0}
        self.config._autohsts_save_state()
-        with mock.patch("certbot_apache.configurator.logger.warning") as mock_log:
+        with mock.patch("certbot_apache._internal.configurator.logger.warning") as mock_log:
            self.config.deploy_autohsts(mock.MagicMock())
            self.assertTrue(mock_log.called)
            self.assertTrue(
@@ -1,13 +1,12 @@
-"""Test for certbot_apache.configurator for CentOS 6 overrides"""
+"""Test for certbot_apache._internal.configurator for CentOS 6 overrides"""
 import unittest

 from certbot.compat import os
 from certbot.errors import MisconfigurationError
-
-from certbot_apache import obj
-from certbot_apache import override_centos
-from certbot_apache import parser
-from certbot_apache.tests import util
+from certbot_apache._internal import obj
+from certbot_apache._internal import override_centos
+from certbot_apache._internal import parser
+import util


 def get_vh_truth(temp_dir, config_name):
@@ -1,4 +1,4 @@
-"""Test for certbot_apache.configurator for Centos overrides"""
+"""Test for certbot_apache._internal.configurator for Centos overrides"""
 import unittest

 import mock
@@ -6,10 +6,9 @@ import mock
 from certbot import errors
 from certbot.compat import filesystem
 from certbot.compat import os
-
-from certbot_apache import obj
-from certbot_apache import override_centos
-from certbot_apache.tests import util
+from certbot_apache._internal import obj
+from certbot_apache._internal import override_centos
+import util


 def get_vh_truth(temp_dir, config_name):
@@ -55,7 +54,7 @@ class FedoraRestartTest(util.ApacheTest):
            self.config.config_test()

    def test_non_fedora_error(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
+        c_test = "certbot_apache._internal.configurator.ApacheConfigurator.config_test"
        with mock.patch(c_test) as mock_test:
            mock_test.side_effect = errors.MisconfigurationError
            with mock.patch("certbot.util.get_os_info") as mock_info:
@@ -64,7 +63,7 @@ class FedoraRestartTest(util.ApacheTest):
                                  self.config.config_test)

    def test_fedora_restart_error(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
+        c_test = "certbot_apache._internal.configurator.ApacheConfigurator.config_test"
        with mock.patch(c_test) as mock_test:
            # First call raises error, second doesn't
            mock_test.side_effect = [errors.MisconfigurationError, '']
@@ -74,7 +73,7 @@ class FedoraRestartTest(util.ApacheTest):
                                  self._run_fedora_test)

    def test_fedora_restart(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
+        c_test = "certbot_apache._internal.configurator.ApacheConfigurator.config_test"
        with mock.patch(c_test) as mock_test:
            with mock.patch("certbot.util.run_script") as mock_run:
                # First call raises error, second doesn't
@@ -107,7 +106,7 @@ class MultipleVhostsTestCentOS(util.ApacheTest):
    def test_get_parser(self):
        self.assertIsInstance(self.config.parser, override_centos.CentOSParser)

-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_opportunistic_httpd_runtime_parsing(self, mock_get):
        define_val = (
            'Define: TEST1\n'
@@ -156,7 +155,7 @@ class MultipleVhostsTestCentOS(util.ApacheTest):
                raise Exception("Missed: %s" % vhost)  # pragma: no cover
        self.assertEqual(found, 2)

-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_get_sysconfig_vars(self, mock_cfg):
        """Make sure we read the sysconfig OPTIONS variable correctly"""
        # Return nothing for the process calls
@@ -177,13 +176,13 @@ class MultipleVhostsTestCentOS(util.ApacheTest):
        self.assertTrue("MOCK_NOSEP" in self.config.parser.variables.keys())
        self.assertEqual("NOSEP_VAL", self.config.parser.variables["NOSEP_TWO"])

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_alt_restart_works(self, mock_run_script):
        mock_run_script.side_effect = [None, errors.SubprocessError, None]
        self.config.restart()
        self.assertEqual(mock_run_script.call_count, 3)

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_alt_restart_errors(self, mock_run_script):
        mock_run_script.side_effect = [None,
                                       errors.SubprocessError,
@@ -1,11 +1,10 @@
-"""Tests for certbot_apache.parser."""
+"""Tests for certbot_apache._internal.parser."""
 import shutil
 import unittest

 from certbot import errors
 from certbot.compat import os
-
-from certbot_apache.tests import util
+import util


 class ComplexParserTest(util.ParserTest):
@@ -88,7 +87,7 @@ class ComplexParserTest(util.ParserTest):

    def verify_fnmatch(self, arg, hit=True):
        """Test if Include was correctly parsed."""
-        from certbot_apache import parser
+        from certbot_apache._internal import parser
        self.parser.add_dir(parser.get_aug_path(self.parser.loc["default"]),
                            "Include", [arg])
        if hit:
@@ -1,12 +1,11 @@
-"""Test for certbot_apache.configurator implementations of reverter"""
+"""Test for certbot_apache._internal.configurator implementations of reverter"""
 import shutil
 import unittest

 import mock

 from certbot import errors
-
-from certbot_apache.tests import util
+import util


 class ConfiguratorReverterTest(util.ApacheTest):
@@ -1,5 +1,5 @@
-# pylint: disable=too-many-public-methods,too-many-lines
-"""Test for certbot_apache.configurator."""
+# pylint: disable=too-many-lines
+"""Test for certbot_apache._internal.configurator."""
 import copy
 import shutil
 import socket
@@ -7,24 +7,21 @@ import tempfile
 import unittest

 import mock
-# six is used in mock.patch()
-import six  # pylint: disable=unused-import
+import six  # pylint: disable=unused-import  # six is used in mock.patch()

 from acme import challenges
-
 from certbot import achallenges
 from certbot import crypto_util
 from certbot import errors
-from certbot.compat import os
 from certbot.compat import filesystem
+from certbot.compat import os
 from certbot.tests import acme_util
 from certbot.tests import util as certbot_util
-
-from certbot_apache import apache_util
-from certbot_apache import constants
-from certbot_apache import obj
-from certbot_apache import parser
-from certbot_apache.tests import util
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import constants
+from certbot_apache._internal import obj
+from certbot_apache._internal import parser
+import util


 class MultipleVhostsTest(util.ApacheTest):
@@ -45,13 +42,13 @@ class MultipleVhostsTest(util.ApacheTest):

        def mocked_deploy_cert(*args, **kwargs):
            """a helper to mock a deployed cert"""
-            g_mod = "certbot_apache.configurator.ApacheConfigurator.enable_mod"
+            g_mod = "certbot_apache._internal.configurator.ApacheConfigurator.enable_mod"
            with mock.patch(g_mod):
                config.real_deploy_cert(*args, **kwargs)
        self.config.deploy_cert = mocked_deploy_cert
        return self.config

-    @mock.patch("certbot_apache.configurator.path_surgery")
+    @mock.patch("certbot_apache._internal.configurator.path_surgery")
    def test_prepare_no_install(self, mock_surgery):
        silly_path = {"PATH": "/tmp/nothingness2342"}
        mock_surgery.return_value = False
@@ -59,8 +56,8 @@ class MultipleVhostsTest(util.ApacheTest):
            self.assertRaises(errors.NoInstallationError, self.config.prepare)
            self.assertEqual(mock_surgery.call_count, 1)

-    @mock.patch("certbot_apache.parser.ApacheParser")
-    @mock.patch("certbot_apache.configurator.util.exe_exists")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser")
+    @mock.patch("certbot_apache._internal.configurator.util.exe_exists")
    def test_prepare_version(self, mock_exe_exists, _):
        mock_exe_exists.return_value = True
        self.config.version = None
@@ -76,10 +73,10 @@ class MultipleVhostsTest(util.ApacheTest):
        os.remove(os.path.join(server_root, ".certbot.lock"))
        certbot_util.lock_and_call(self._test_prepare_locked, server_root)

-    @mock.patch("certbot_apache.parser.ApacheParser")
-    @mock.patch("certbot_apache.configurator.util.exe_exists")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.get_parsernode_root")
-    def _test_prepare_locked(self, _node, _exists, _parser):
+    @mock.patch("certbot_apache._internal.parser.ApacheParser")
+    @mock.patch("certbot_apache._internal.configurator.util.exe_exists")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.get_parsernode_root")
+    def _test_prepare_locked(self, unused_parser, unused_exe_exists):
        try:
            self.config.prepare()
        except errors.PluginError as err:
@@ -90,13 +87,13 @@ class MultipleVhostsTest(util.ApacheTest):
            self.fail("Exception wasn't raised!")

    def test_add_parser_arguments(self):  # pylint: disable=no-self-use
-        from certbot_apache.configurator import ApacheConfigurator
+        from certbot_apache._internal.configurator import ApacheConfigurator
        # Weak test..
        ApacheConfigurator.add_parser_arguments(mock.MagicMock())

    def test_docs_parser_arguments(self):
        os.environ["CERTBOT_DOCS"] = "1"
-        from certbot_apache.configurator import ApacheConfigurator
+        from certbot_apache._internal.configurator import ApacheConfigurator
        mock_add = mock.MagicMock()
        ApacheConfigurator.add_parser_arguments(mock_add)
        parserargs = ["server_root", "enmod", "dismod", "le_vhost_ext",
@@ -109,13 +106,9 @@ class MultipleVhostsTest(util.ApacheTest):
                exp[k.replace("_", "-")] = ApacheConfigurator.OS_DEFAULTS[k]
        # Special cases
        exp["vhost-root"] = None
-        exp["init-script"] = None

        found = set()
        for call in mock_add.call_args_list:
-            # init-script is a special case: deprecated argument
-            if call[0][0] != "init-script":
-                self.assertEqual(exp[call[0][0]], call[1]['default'])
            found.add(call[0][0])

        # Make sure that all (and only) the expected values exist
@@ -126,13 +119,13 @@ class MultipleVhostsTest(util.ApacheTest):
        del os.environ["CERTBOT_DOCS"]

    def test_add_parser_arguments_all_configurators(self):  # pylint: disable=no-self-use
-        from certbot_apache.entrypoint import OVERRIDE_CLASSES
+        from certbot_apache._internal.entrypoint import OVERRIDE_CLASSES
        for cls in OVERRIDE_CLASSES.values():
            cls.add_parser_arguments(mock.MagicMock())

    def test_all_configurators_defaults_defined(self):
-        from certbot_apache.entrypoint import OVERRIDE_CLASSES
-        from certbot_apache.configurator import ApacheConfigurator
+        from certbot_apache._internal.entrypoint import OVERRIDE_CLASSES
+        from certbot_apache._internal.configurator import ApacheConfigurator
        parameters = set(ApacheConfigurator.OS_DEFAULTS.keys())
        for cls in OVERRIDE_CLASSES.values():
            self.assertTrue(parameters.issubset(set(cls.OS_DEFAULTS.keys())))
@@ -154,7 +147,7 @@ class MultipleVhostsTest(util.ApacheTest):
        ))

    @certbot_util.patch_get_utility()
-    @mock.patch("certbot_apache.configurator.socket.gethostbyaddr")
+    @mock.patch("certbot_apache._internal.configurator.socket.gethostbyaddr")
    def test_get_all_names_addrs(self, mock_gethost, mock_getutility):
        mock_gethost.side_effect = [("google.com", "", ""), socket.error]
        mock_utility = mock_getutility()
@@ -180,7 +173,7 @@ class MultipleVhostsTest(util.ApacheTest):
        self.assertEqual(self.config._create_vhost("nonexistent"), None) # pylint: disable=protected-access

    def test_get_aug_internal_path(self):
-        from certbot_apache.apache_util import get_internal_aug_path
+        from certbot_apache._internal.apache_util import get_internal_aug_path
        internal_paths = [
            "Virtualhost", "IfModule/VirtualHost", "VirtualHost", "VirtualHost",
            "Macro/VirtualHost", "IfModule/VirtualHost", "VirtualHost",
@@ -225,26 +218,26 @@ class MultipleVhostsTest(util.ApacheTest):

        # Handle case of non-debian layout get_virtual_hosts
        with mock.patch(
-                "certbot_apache.configurator.ApacheConfigurator.conf"
+                "certbot_apache._internal.configurator.ApacheConfigurator.conf"
        ) as mock_conf:
            mock_conf.return_value = False
            vhs = self.config.get_virtual_hosts()
            self.assertEqual(len(vhs), 12)

-    @mock.patch("certbot_apache.display_ops.select_vhost")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost")
    def test_choose_vhost_none_avail(self, mock_select):
        mock_select.return_value = None
        self.assertRaises(
            errors.PluginError, self.config.choose_vhost, "none.com")

-    @mock.patch("certbot_apache.display_ops.select_vhost")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost")
    def test_choose_vhost_select_vhost_ssl(self, mock_select):
        mock_select.return_value = self.vh_truth[1]
        self.assertEqual(
            self.vh_truth[1], self.config.choose_vhost("none.com"))

-    @mock.patch("certbot_apache.display_ops.select_vhost")
-    @mock.patch("certbot_apache.obj.VirtualHost.conflicts")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost")
+    @mock.patch("certbot_apache._internal.obj.VirtualHost.conflicts")
    def test_choose_vhost_select_vhost_non_ssl(self, mock_conf, mock_select):
        mock_select.return_value = self.vh_truth[0]
        mock_conf.return_value = False
@@ -257,8 +250,8 @@ class MultipleVhostsTest(util.ApacheTest):
        self.assertFalse(self.vh_truth[0].ssl)
        self.assertTrue(chosen_vhost.ssl)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._find_best_vhost")
-    @mock.patch("certbot_apache.parser.ApacheParser.add_dir")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator._find_best_vhost")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.add_dir")
    def test_choose_vhost_and_servername_addition(self, mock_add, mock_find):
        ret_vh = self.vh_truth[8]
        ret_vh.enabled = False
@@ -266,13 +259,13 @@ class MultipleVhostsTest(util.ApacheTest):
        self.config.choose_vhost("whatever.com")
        self.assertTrue(mock_add.called)

-    @mock.patch("certbot_apache.display_ops.select_vhost")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost")
    def test_choose_vhost_select_vhost_with_temp(self, mock_select):
        mock_select.return_value = self.vh_truth[0]
        chosen_vhost = self.config.choose_vhost("none.com", create_if_no_ssl=False)
        self.assertEqual(self.vh_truth[0], chosen_vhost)

-    @mock.patch("certbot_apache.display_ops.select_vhost")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost")
    def test_choose_vhost_select_vhost_conflicting_non_ssl(self, mock_select):
        mock_select.return_value = self.vh_truth[3]
        conflicting_vhost = obj.VirtualHost(
@@ -789,8 +782,8 @@ class MultipleVhostsTest(util.ApacheTest):
        self.config._add_name_vhost_if_necessary(self.vh_truth[0])
        self.assertEqual(self.config.add_name_vhost.call_count, 2)

-    @mock.patch("certbot_apache.configurator.http_01.ApacheHttp01.perform")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.configurator.http_01.ApacheHttp01.perform")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
    def test_perform(self, mock_restart, mock_http_perform):
        # Only tests functionality specific to configurator.perform
        # Note: As more challenges are offered this will have to be expanded
@@ -806,8 +799,8 @@ class MultipleVhostsTest(util.ApacheTest):

        self.assertEqual(mock_restart.call_count, 1)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_cleanup(self, mock_cfg, mock_restart):
        mock_cfg.return_value = ""
        _, achalls = self.get_key_and_achalls()
@@ -822,8 +815,8 @@ class MultipleVhostsTest(util.ApacheTest):
            else:
                self.assertFalse(mock_restart.called)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_cleanup_no_errors(self, mock_cfg, mock_restart):
        mock_cfg.return_value = ""
        _, achalls = self.get_key_and_achalls()
@@ -860,11 +853,11 @@ class MultipleVhostsTest(util.ApacheTest):
        mock_script.side_effect = errors.SubprocessError("Can't find program")
        self.assertRaises(errors.PluginError, self.config.get_version)

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_restart(self, _):
        self.config.restart()

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_restart_bad_process(self, mock_run_script):
        mock_run_script.side_effect = [None, errors.SubprocessError]

@@ -907,8 +900,8 @@ class MultipleVhostsTest(util.ApacheTest):
        self.assertEqual(self.vh_truth[0].name, res.name)
        self.assertEqual(self.vh_truth[0].aliases, res.aliases)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._get_http_vhost")
-    @mock.patch("certbot_apache.display_ops.select_vhost")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator._get_http_vhost")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost")
    @mock.patch("certbot.util.exe_exists")
    def test_enhance_unknown_vhost(self, mock_exe, mock_sel_vhost, mock_get):
        self.config.parser.modules.add("rewrite_module")
@@ -931,7 +924,7 @@ class MultipleVhostsTest(util.ApacheTest):
            self.config.enhance, "certbot.demo", "unknown_enhancement")

    def test_enhance_no_ssl_vhost(self):
-        with mock.patch("certbot_apache.configurator.logger.warning") as mock_log:
+        with mock.patch("certbot_apache._internal.configurator.logger.warning") as mock_log:
            self.assertRaises(errors.PluginError, self.config.enhance,
                              "certbot.demo", "redirect")
            # Check that correct logger.warning was printed
@@ -1236,7 +1229,7 @@ class MultipleVhostsTest(util.ApacheTest):
        self.config.choose_vhost("red.blue.purple.com")

        self.config.enhance("red.blue.purple.com", "redirect")
-        verify_no_redirect = ("certbot_apache.configurator."
+        verify_no_redirect = ("certbot_apache._internal.configurator."
                              "ApacheConfigurator._verify_no_certbot_redirect")
        with mock.patch(verify_no_redirect) as mock_verify:
            self.config.enhance("green.blue.purple.com", "redirect")
@@ -1297,13 +1290,13 @@ class MultipleVhostsTest(util.ApacheTest):
        account_key = self.rsa512jwk
        achall1 = achallenges.KeyAuthorizationAnnotatedChallenge(
            challb=acme_util.chall_to_challb(
-                challenges.TLSSNI01(
+                challenges.HTTP01(
                    token=b"jIq_Xy1mXGN37tb4L6Xj_es58fW571ZNyXekdZzhh7Q"),
                "pending"),
            domain="encryption-example.demo", account_key=account_key)
        achall2 = achallenges.KeyAuthorizationAnnotatedChallenge(
            challb=acme_util.chall_to_challb(
-                challenges.TLSSNI01(
+                challenges.HTTP01(
                    token=b"uqnaPzxtrndteOqtrXb0Asl5gOJfWAnnx6QJyvcmlDU"),
                "pending"),
            domain="certbot.demo", account_key=account_key)
@@ -1338,8 +1331,8 @@ class MultipleVhostsTest(util.ApacheTest):
        self.config.parser.modules.add("socache_shmcb_module")
        tmp_path = filesystem.realpath(tempfile.mkdtemp("vhostroot"))
        filesystem.chmod(tmp_path, 0o755)
-        mock_p = "certbot_apache.configurator.ApacheConfigurator._get_ssl_vhost_path"
-        mock_a = "certbot_apache.parser.ApacheParser.add_include"
+        mock_p = "certbot_apache._internal.configurator.ApacheConfigurator._get_ssl_vhost_path"
+        mock_a = "certbot_apache._internal.parser.ApacheParser.add_include"

        with mock.patch(mock_p) as mock_path:
            mock_path.return_value = os.path.join(tmp_path, "whatever.conf")
@@ -1352,7 +1345,7 @@ class MultipleVhostsTest(util.ApacheTest):
                self.assertTrue(mock_add.called)
        shutil.rmtree(tmp_path)

-    @mock.patch("certbot_apache.parser.ApacheParser.parsed_in_original")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.parsed_in_original")
    def test_choose_vhost_and_servername_addition_parsed(self, mock_parsed):
        ret_vh = self.vh_truth[8]
        ret_vh.enabled = True
@@ -1374,7 +1367,7 @@ class MultipleVhostsTest(util.ApacheTest):

    def test_choose_vhosts_wildcard(self):
        # pylint: disable=protected-access
-        mock_path = "certbot_apache.display_ops.select_vhost_multiple"
+        mock_path = "certbot_apache._internal.display_ops.select_vhost_multiple"
        with mock.patch(mock_path) as mock_select_vhs:
            mock_select_vhs.return_value = [self.vh_truth[3]]
            vhs = self.config._choose_vhosts_wildcard("*.certbot.demo",
@@ -1390,10 +1383,10 @@ class MultipleVhostsTest(util.ApacheTest):

            self.assertFalse(vhs[0] == self.vh_truth[3])

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.make_vhost_ssl")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.make_vhost_ssl")
    def test_choose_vhosts_wildcard_no_ssl(self, mock_makessl):
        # pylint: disable=protected-access
-        mock_path = "certbot_apache.display_ops.select_vhost_multiple"
+        mock_path = "certbot_apache._internal.display_ops.select_vhost_multiple"
        with mock.patch(mock_path) as mock_select_vhs:
            mock_select_vhs.return_value = [self.vh_truth[1]]
            vhs = self.config._choose_vhosts_wildcard("*.certbot.demo",
@@ -1401,13 +1394,13 @@ class MultipleVhostsTest(util.ApacheTest):
            self.assertFalse(mock_makessl.called)
            self.assertEqual(vhs[0], self.vh_truth[1])

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._vhosts_for_wildcard")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.make_vhost_ssl")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator._vhosts_for_wildcard")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.make_vhost_ssl")
    def test_choose_vhosts_wildcard_already_ssl(self, mock_makessl, mock_vh_for_w):
        # pylint: disable=protected-access
        # Already SSL vhost
        mock_vh_for_w.return_value = [self.vh_truth[7]]
-        mock_path = "certbot_apache.display_ops.select_vhost_multiple"
+        mock_path = "certbot_apache._internal.display_ops.select_vhost_multiple"
        with mock.patch(mock_path) as mock_select_vhs:
            mock_select_vhs.return_value = [self.vh_truth[7]]
            vhs = self.config._choose_vhosts_wildcard("whatever",
@@ -1428,7 +1421,7 @@ class MultipleVhostsTest(util.ApacheTest):
        mock_choose_vhosts = mock.MagicMock()
        mock_choose_vhosts.return_value = [self.vh_truth[7]]
        self.config._choose_vhosts_wildcard = mock_choose_vhosts
-        mock_d = "certbot_apache.configurator.ApacheConfigurator._deploy_cert"
+        mock_d = "certbot_apache._internal.configurator.ApacheConfigurator._deploy_cert"
        with mock.patch(mock_d) as mock_dep:
            self.config.deploy_cert("*.wildcard.example.org", "/tmp/path",
                                    "/tmp/path", "/tmp/path", "/tmp/path")
@@ -1436,7 +1429,7 @@ class MultipleVhostsTest(util.ApacheTest):
            self.assertEqual(len(mock_dep.call_args_list), 1)
            self.assertEqual(self.vh_truth[7], mock_dep.call_args_list[0][0][0])

-    @mock.patch("certbot_apache.display_ops.select_vhost_multiple")
+    @mock.patch("certbot_apache._internal.display_ops.select_vhost_multiple")
    def test_deploy_cert_wildcard_no_vhosts(self, mock_dialog):
        # pylint: disable=protected-access
        mock_dialog.return_value = []
@@ -1445,7 +1438,7 @@ class MultipleVhostsTest(util.ApacheTest):
                          "*.wild.cat", "/tmp/path", "/tmp/path",
                           "/tmp/path", "/tmp/path")

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._choose_vhosts_wildcard")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator._choose_vhosts_wildcard")
    def test_enhance_wildcard_after_install(self, mock_choose):
        # pylint: disable=protected-access
        self.config.parser.modules.add("mod_ssl.c")
@@ -1456,7 +1449,7 @@ class MultipleVhostsTest(util.ApacheTest):
                            "Upgrade-Insecure-Requests")
        self.assertFalse(mock_choose.called)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._choose_vhosts_wildcard")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator._choose_vhosts_wildcard")
    def test_enhance_wildcard_no_install(self, mock_choose):
        self.vh_truth[3].ssl = True
        mock_choose.return_value = [self.vh_truth[3]]
@@ -1533,7 +1526,7 @@ class AugeasVhostsTest(util.ApacheTest):
        chosen_vhost = self.config._create_vhost(path)
        self.assertTrue(chosen_vhost is None or chosen_vhost.path == path)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._create_vhost")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator._create_vhost")
    def test_get_vhost_continue(self, mock_vhost):
        mock_vhost.return_value = None
        vhs = self.config.get_virtual_hosts()
@@ -1545,18 +1538,18 @@ class AugeasVhostsTest(util.ApacheTest):
        for name in names:
            self.assertFalse(name in self.config.choose_vhost(name).aliases)

-    @mock.patch("certbot_apache.obj.VirtualHost.conflicts")
+    @mock.patch("certbot_apache._internal.obj.VirtualHost.conflicts")
    def test_choose_vhost_without_matching_wildcard(self, mock_conflicts):
        mock_conflicts.return_value = False
-        mock_path = "certbot_apache.display_ops.select_vhost"
+        mock_path = "certbot_apache._internal.display_ops.select_vhost"
        with mock.patch(mock_path, lambda _, vhosts: vhosts[0]):
            for name in ("a.example.net", "other.example.net"):
                self.assertTrue(name in self.config.choose_vhost(name).aliases)

-    @mock.patch("certbot_apache.obj.VirtualHost.conflicts")
+    @mock.patch("certbot_apache._internal.obj.VirtualHost.conflicts")
    def test_choose_vhost_wildcard_not_found(self, mock_conflicts):
        mock_conflicts.return_value = False
-        mock_path = "certbot_apache.display_ops.select_vhost"
+        mock_path = "certbot_apache._internal.display_ops.select_vhost"
        names = (
            "abc.example.net", "not.there.tld", "aa.wildcard.tld"
        )
@@ -1568,7 +1561,7 @@ class AugeasVhostsTest(util.ApacheTest):
                self.assertEqual(mock_select.call_count - orig_cc, 1)

    def test_choose_vhost_wildcard_found(self):
-        mock_path = "certbot_apache.display_ops.select_vhost"
+        mock_path = "certbot_apache._internal.display_ops.select_vhost"
        names = (
            "ab.example.net", "a.wildcard.tld", "yetanother.example.net"
        )
@@ -1622,7 +1615,7 @@ class MultiVhostsTest(util.ApacheTest):
        self.assertEqual(self.config.is_name_vhost(self.vh_truth[1]),
                         self.config.is_name_vhost(ssl_vhost))

-        mock_path = "certbot_apache.configurator.ApacheConfigurator._get_new_vh_path"
+        mock_path = "certbot_apache._internal.configurator.ApacheConfigurator._get_new_vh_path"
        with mock.patch(mock_path) as mock_getpath:
            mock_getpath.return_value = None
            self.assertRaises(errors.PluginError, self.config.make_vhost_ssl,
@@ -1728,7 +1721,7 @@ class InstallSslOptionsConfTest(util.ApacheTest):
        self._assert_current_file()

    def test_prev_file_updates_to_current(self):
-        from certbot_apache.constants import ALL_SSL_OPTIONS_HASHES
+        from certbot_apache._internal.constants import ALL_SSL_OPTIONS_HASHES
        ALL_SSL_OPTIONS_HASHES.insert(0, "test_hash_does_not_match")
        with mock.patch('certbot.crypto_util.sha256sum') as mock_sha256:
            mock_sha256.return_value = ALL_SSL_OPTIONS_HASHES[0]
@@ -1767,7 +1760,7 @@ class InstallSslOptionsConfTest(util.ApacheTest):
            self.assertFalse(mock_logger.warning.called)

    def test_current_file_hash_in_all_hashes(self):
-        from certbot_apache.constants import ALL_SSL_OPTIONS_HASHES
+        from certbot_apache._internal.constants import ALL_SSL_OPTIONS_HASHES
        self.assertTrue(self._current_ssl_options_hash() in ALL_SSL_OPTIONS_HASHES,
            "Constants.ALL_SSL_OPTIONS_HASHES must be appended"
            " with the sha256 hash of self.config.mod_ssl_conf when it is updated.")
@@ -1,4 +1,4 @@
-"""Test for certbot_apache.configurator for Debian overrides"""
+"""Test for certbot_apache._internal.configurator for Debian overrides"""
 import shutil
 import unittest

@@ -6,10 +6,9 @@ import mock

 from certbot import errors
 from certbot.compat import os
-
-from certbot_apache import apache_util
-from certbot_apache import obj
-from certbot_apache.tests import util
+from certbot_apache._internal import apache_util
+from certbot_apache._internal import obj
+import util


 class MultipleVhostsTestDebian(util.ApacheTest):
@@ -32,8 +31,8 @@ class MultipleVhostsTestDebian(util.ApacheTest):

        def mocked_deploy_cert(*args, **kwargs):
            """a helper to mock a deployed cert"""
-            g_mod = "certbot_apache.configurator.ApacheConfigurator.enable_mod"
-            d_mod = "certbot_apache.override_debian.DebianConfigurator.enable_mod"
+            g_mod = "certbot_apache._internal.configurator.ApacheConfigurator.enable_mod"
+            d_mod = "certbot_apache._internal.override_debian.DebianConfigurator.enable_mod"
            with mock.patch(g_mod):
                with mock.patch(d_mod):
                    config.real_deploy_cert(*args, **kwargs)
@@ -47,7 +46,7 @@ class MultipleVhostsTestDebian(util.ApacheTest):

    @mock.patch("certbot.util.run_script")
    @mock.patch("certbot.util.exe_exists")
-    @mock.patch("certbot_apache.apache_util.subprocess.Popen")
+    @mock.patch("certbot_apache._internal.parser.subprocess.Popen")
    def test_enable_mod(self, mock_popen, mock_exe_exists, mock_run_script):
        mock_popen().communicate.return_value = ("Define: DUMP_RUN_CFG", "")
        mock_popen().returncode = 0
@@ -196,7 +195,7 @@ class MultipleVhostsTestDebian(util.ApacheTest):

    def test_enable_site_call_parent(self):
        with mock.patch(
-            "certbot_apache.configurator.ApacheConfigurator.enable_site") as e_s:
+            "certbot_apache._internal.configurator.ApacheConfigurator.enable_site") as e_s:
            self.config.parser.root = "/tmp/nonexistent"
            vh = self.vh_truth[0]
            vh.enabled = False
@@ -1,22 +1,18 @@
-"""Test certbot_apache.display_ops."""
+"""Test certbot_apache._internal.display_ops."""
 import unittest

 import mock

 from certbot import errors
-
 from certbot.display import util as display_util
-
 from certbot.tests import util as certbot_util
-
-from certbot_apache import obj
-
-from certbot_apache.display_ops import select_vhost_multiple
-from certbot_apache.tests import util
+from certbot_apache._internal import obj
+from certbot_apache._internal.display_ops import select_vhost_multiple
+import util


 class SelectVhostMultiTest(unittest.TestCase):
-    """Tests for certbot_apache.display_ops.select_vhost_multiple."""
+    """Tests for certbot_apache._internal.display_ops.select_vhost_multiple."""

    def setUp(self):
        self.base_dir = "/example_path"
@@ -45,7 +41,7 @@ class SelectVhostMultiTest(unittest.TestCase):
        self.assertFalse(vhs)

 class SelectVhostTest(unittest.TestCase):
-    """Tests for certbot_apache.display_ops.select_vhost."""
+    """Tests for certbot_apache._internal.display_ops.select_vhost."""

    def setUp(self):
        self.base_dir = "/example_path"
@@ -54,7 +50,7 @@ class SelectVhostTest(unittest.TestCase):

    @classmethod
    def _call(cls, vhosts):
-        from certbot_apache.display_ops import select_vhost
+        from certbot_apache._internal.display_ops import select_vhost
        return select_vhost("example.com", vhosts)

    @certbot_util.patch_get_utility()
@@ -81,9 +77,9 @@ class SelectVhostTest(unittest.TestCase):
    def test_no_vhosts(self):
        self.assertEqual(self._call([]), None)

-    @mock.patch("certbot_apache.display_ops.display_util")
+    @mock.patch("certbot_apache._internal.display_ops.display_util")
    @certbot_util.patch_get_utility()
-    @mock.patch("certbot_apache.display_ops.logger")
+    @mock.patch("certbot_apache._internal.display_ops.logger")
    def test_small_display(self, mock_logger, mock_util, mock_display_util):
        mock_display_util.WIDTH = 20
        mock_util().menu.return_value = (display_util.OK, 0)
@@ -1,10 +1,10 @@
-"""Test for certbot_apache.entrypoint for override class resolution"""
+"""Test for certbot_apache._internal.entrypoint for override class resolution"""
 import unittest

 import mock

-from certbot_apache import configurator
-from certbot_apache import entrypoint
+from certbot_apache._internal import configurator
+from certbot_apache._internal import entrypoint


 class EntryPointTest(unittest.TestCase):
@@ -1,4 +1,4 @@
-"""Test for certbot_apache.configurator for Fedora 29+ overrides"""
+"""Test for certbot_apache._internal.configurator for Fedora 29+ overrides"""
 import unittest

 import mock
@@ -6,10 +6,9 @@ import mock
 from certbot import errors
 from certbot.compat import filesystem
 from certbot.compat import os
-
-from certbot_apache import obj
-from certbot_apache import override_fedora
-from certbot_apache.tests import util
+from certbot_apache._internal import obj
+from certbot_apache._internal import override_fedora
+import util


 def get_vh_truth(temp_dir, config_name):
@@ -58,7 +57,7 @@ class FedoraRestartTest(util.ApacheTest):
        self.config.config_test()

    def test_fedora_restart_error(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
+        c_test = "certbot_apache._internal.configurator.ApacheConfigurator.config_test"
        with mock.patch(c_test) as mock_test:
            # First call raises error, second doesn't
            mock_test.side_effect = [errors.MisconfigurationError, '']
@@ -68,7 +67,7 @@ class FedoraRestartTest(util.ApacheTest):
                                  self._run_fedora_test)

    def test_fedora_restart(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
+        c_test = "certbot_apache._internal.configurator.ApacheConfigurator.config_test"
        with mock.patch(c_test) as mock_test:
            with mock.patch("certbot.util.run_script") as mock_run:
                # First call raises error, second doesn't
@@ -101,7 +100,7 @@ class MultipleVhostsTestFedora(util.ApacheTest):
    def test_get_parser(self):
        self.assertIsInstance(self.config.parser, override_fedora.FedoraParser)

-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_opportunistic_httpd_runtime_parsing(self, mock_get):
        define_val = (
            'Define: TEST1\n'
@@ -135,7 +134,7 @@ class MultipleVhostsTestFedora(util.ApacheTest):
        self.assertTrue("TEST2" in self.config.parser.variables.keys())
        self.assertTrue("mod_another.c" in self.config.parser.modules)

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_get_version(self, mock_run_script):
        mock_run_script.return_value = ('', None)
        self.assertRaises(errors.PluginError, self.config.get_version)
@@ -156,7 +155,7 @@ class MultipleVhostsTestFedora(util.ApacheTest):
                raise Exception("Missed: %s" % vhost)  # pragma: no cover
        self.assertEqual(found, 2)

-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_get_sysconfig_vars(self, mock_cfg):
        """Make sure we read the sysconfig OPTIONS variable correctly"""
        # Return nothing for the process calls
@@ -177,13 +176,13 @@ class MultipleVhostsTestFedora(util.ApacheTest):
        self.assertTrue("MOCK_NOSEP" in self.config.parser.variables.keys())
        self.assertEqual("NOSEP_VAL", self.config.parser.variables["NOSEP_TWO"])

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_alt_restart_works(self, mock_run_script):
        mock_run_script.side_effect = [None, errors.SubprocessError, None]
        self.config.restart()
        self.assertEqual(mock_run_script.call_count, 3)

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_alt_restart_errors(self, mock_run_script):
        mock_run_script.side_effect = [None,
                                       errors.SubprocessError,
@@ -1,4 +1,4 @@
-"""Test for certbot_apache.configurator for Gentoo overrides"""
+"""Test for certbot_apache._internal.configurator for Gentoo overrides"""
 import unittest

 import mock
@@ -6,10 +6,9 @@ import mock
 from certbot import errors
 from certbot.compat import filesystem
 from certbot.compat import os
-
-from certbot_apache import obj
-from certbot_apache import override_gentoo
-from certbot_apache.tests import util
+from certbot_apache._internal import obj
+from certbot_apache._internal import override_gentoo
+import util


 def get_vh_truth(temp_dir, config_name):
@@ -52,7 +51,8 @@ class MultipleVhostsTestGentoo(util.ApacheTest):
                                                    config_root=config_root,
                                                    vhost_root=vhost_root)

-        with mock.patch("certbot_apache.override_gentoo.GentooParser.update_runtime_variables"):
+        # pylint: disable=line-too-long
+        with mock.patch("certbot_apache._internal.override_gentoo.GentooParser.update_runtime_variables"):
            self.config = util.get_apache_configurator(
                self.config_path, self.vhost_path, self.config_dir, self.work_dir,
                os_info="gentoo")
@@ -85,17 +85,17 @@ class MultipleVhostsTestGentoo(util.ApacheTest):
        self.config.parser.apacheconfig_filep = filesystem.realpath(
            os.path.join(self.config.parser.root, "../conf.d/apache2"))
        self.config.parser.variables = {}
-        with mock.patch("certbot_apache.override_gentoo.GentooParser.update_modules"):
+        with mock.patch("certbot_apache._internal.override_gentoo.GentooParser.update_modules"):
            self.config.parser.update_runtime_variables()
        for define in defines:
            self.assertTrue(define in self.config.parser.variables.keys())

-    @mock.patch("certbot_apache.apache_util.parse_from_subprocess")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.parse_from_subprocess")
    def test_no_binary_configdump(self, mock_subprocess):
        """Make sure we don't call binary dumps other than modules from Apache
        as this is not supported in Gentoo currently"""

-        with mock.patch("certbot_apache.override_gentoo.GentooParser.update_modules"):
+        with mock.patch("certbot_apache._internal.override_gentoo.GentooParser.update_modules"):
            self.config.parser.update_runtime_variables()
            self.config.parser.reset_modules()
        self.assertFalse(mock_subprocess.called)
@@ -104,7 +104,7 @@ class MultipleVhostsTestGentoo(util.ApacheTest):
        self.config.parser.reset_modules()
        self.assertTrue(mock_subprocess.called)

-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_opportunistic_httpd_runtime_parsing(self, mock_get):
        mod_val = (
            'Loaded Modules:\n'
@@ -128,7 +128,7 @@ class MultipleVhostsTestGentoo(util.ApacheTest):
        self.assertEqual(len(self.config.parser.modules), 4)
        self.assertTrue("mod_another.c" in self.config.parser.modules)

-    @mock.patch("certbot_apache.configurator.util.run_script")
+    @mock.patch("certbot_apache._internal.configurator.util.run_script")
    def test_alt_restart_works(self, mock_run_script):
        mock_run_script.side_effect = [None, errors.SubprocessError, None]
        self.config.restart()
@@ -1,25 +1,23 @@
-"""Test for certbot_apache.http_01."""
+"""Test for certbot_apache._internal.http_01."""
 import unittest
+
 import mock

 from acme import challenges
 from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
-
 from certbot import achallenges
 from certbot import errors
 from certbot.compat import filesystem
 from certbot.compat import os
 from certbot.tests import acme_util
-
-from certbot_apache.parser import get_aug_path
-from certbot_apache.tests import util
-
+from certbot_apache._internal.parser import get_aug_path
+import util

 NUM_ACHALLS = 3


 class ApacheHttp01Test(util.ApacheTest):
-    """Test for certbot_apache.http_01.ApacheHttp01."""
+    """Test for certbot_apache._internal.http_01.ApacheHttp01."""

    def setUp(self, *args, **kwargs):  # pylint: disable=arguments-differ
        super(ApacheHttp01Test, self).setUp(*args, **kwargs)
@@ -45,13 +43,13 @@ class ApacheHttp01Test(util.ApacheTest):
            self.config.parser.modules.add("mod_{0}.c".format(mod))
            self.config.parser.modules.add(mod + "_module")

-        from certbot_apache.http_01 import ApacheHttp01
+        from certbot_apache._internal.http_01 import ApacheHttp01
        self.http = ApacheHttp01(self.config)

    def test_empty_perform(self):
        self.assertFalse(self.http.perform())

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.enable_mod")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.enable_mod")
    def test_enable_modules_apache_2_2(self, mock_enmod):
        self.config.version = (2, 2)
        self.config.parser.modules.remove("authz_host_module")
@@ -60,7 +58,7 @@ class ApacheHttp01Test(util.ApacheTest):
        enmod_calls = self.common_enable_modules_test(mock_enmod)
        self.assertEqual(enmod_calls[0][0][0], "authz_host")

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.enable_mod")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.enable_mod")
    def test_enable_modules_apache_2_4(self, mock_enmod):
        self.config.parser.modules.remove("authz_core_module")
        self.config.parser.modules.remove("mod_authz_core.c")
@@ -1,4 +1,4 @@
-"""Tests for certbot_apache.obj."""
+"""Tests for certbot_apache._internal.obj."""
 import unittest


@@ -6,8 +6,8 @@ class VirtualHostTest(unittest.TestCase):
    """Test the VirtualHost class."""

    def setUp(self):
-        from certbot_apache.obj import Addr
-        from certbot_apache.obj import VirtualHost
+        from certbot_apache._internal.obj import Addr
+        from certbot_apache._internal.obj import VirtualHost

        self.addr1 = Addr.fromstring("127.0.0.1")
        self.addr2 = Addr.fromstring("127.0.0.1:443")
@@ -23,7 +23,8 @@ class VirtualHostTest(unittest.TestCase):
            "fp", "vhp", set([self.addr2]), False, False, "localhost")

    def test_repr(self):
-        self.assertEqual(repr(self.addr2), "certbot_apache.obj.Addr(('127.0.0.1', '443'))")
+        self.assertEqual(repr(self.addr2),
+            "certbot_apache._internal.obj.Addr(('127.0.0.1', '443'))")

    def test_eq(self):
        self.assertTrue(self.vhost1b == self.vhost1)
@@ -36,8 +37,8 @@ class VirtualHostTest(unittest.TestCase):
        self.assertFalse(self.vhost1 != self.vhost1b)

    def test_conflicts(self):
-        from certbot_apache.obj import Addr
-        from certbot_apache.obj import VirtualHost
+        from certbot_apache._internal.obj import Addr
+        from certbot_apache._internal.obj import VirtualHost

        complex_vh = VirtualHost(
            "fp", "vhp",
@@ -54,7 +55,7 @@ class VirtualHostTest(unittest.TestCase):
                                                self.addr_default]))

    def test_same_server(self):
-        from certbot_apache.obj import VirtualHost
+        from certbot_apache._internal.obj import VirtualHost
        no_name1 = VirtualHost(
            "fp", "vhp", set([self.addr1]), False, False, None)
        no_name2 = VirtualHost(
@@ -77,7 +78,7 @@ class VirtualHostTest(unittest.TestCase):
 class AddrTest(unittest.TestCase):
    """Test obj.Addr."""
    def setUp(self):
-        from certbot_apache.obj import Addr
+        from certbot_apache._internal.obj import Addr
        self.addr = Addr.fromstring("*:443")

        self.addr1 = Addr.fromstring("127.0.0.1")
@@ -92,7 +93,7 @@ class AddrTest(unittest.TestCase):
        self.assertTrue(self.addr2.is_wildcard())

    def test_get_sni_addr(self):
-        from certbot_apache.obj import Addr
+        from certbot_apache._internal.obj import Addr
        self.assertEqual(
            self.addr.get_sni_addr("443"), Addr.fromstring("*:443"))
        self.assertEqual(
@@ -1,5 +1,4 @@
-# pylint: disable=too-many-public-methods
-"""Tests for certbot_apache.parser."""
+"""Tests for certbot_apache._internal.parser."""
 import shutil
 import unittest

@@ -7,8 +6,7 @@ import mock

 from certbot import errors
 from certbot.compat import os
-
-from certbot_apache.tests import util
+import util


 class BasicParserTest(util.ParserTest):
@@ -114,7 +112,7 @@ class BasicParserTest(util.ParserTest):
        Path must be valid before attempting to add to augeas

        """
-        from certbot_apache.parser import get_aug_path
+        from certbot_apache._internal.parser import get_aug_path
        # This makes sure that find_dir will work
        self.parser.modules.add("mod_ssl.c")

@@ -128,7 +126,7 @@ class BasicParserTest(util.ParserTest):
        self.assertTrue("IfModule" in matches[0])

    def test_add_dir_to_ifmodssl_multiple(self):
-        from certbot_apache.parser import get_aug_path
+        from certbot_apache._internal.parser import get_aug_path
        # This makes sure that find_dir will work
        self.parser.modules.add("mod_ssl.c")

@@ -142,11 +140,11 @@ class BasicParserTest(util.ParserTest):
        self.assertTrue("IfModule" in matches[0])

    def test_get_aug_path(self):
-        from certbot_apache.parser import get_aug_path
+        from certbot_apache._internal.parser import get_aug_path
        self.assertEqual("/files/etc/apache", get_aug_path("/etc/apache"))

    def test_set_locations(self):
-        with mock.patch("certbot_apache.parser.os.path") as mock_path:
+        with mock.patch("certbot_apache._internal.parser.os.path") as mock_path:

            mock_path.isfile.side_effect = [False, False]

@@ -156,18 +154,18 @@ class BasicParserTest(util.ParserTest):
            self.assertEqual(results["default"], results["listen"])
            self.assertEqual(results["default"], results["name"])

-    @mock.patch("certbot_apache.parser.ApacheParser.find_dir")
-    @mock.patch("certbot_apache.parser.ApacheParser.get_arg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.find_dir")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.get_arg")
    def test_parse_modules_bad_syntax(self, mock_arg, mock_find):
        mock_find.return_value = ["1", "2", "3", "4", "5", "6", "7", "8"]
        mock_arg.return_value = None
-        with mock.patch("certbot_apache.parser.logger") as mock_logger:
+        with mock.patch("certbot_apache._internal.parser.logger") as mock_logger:
            self.parser.parse_modules()
            # Make sure that we got None return value and logged the file
            self.assertTrue(mock_logger.debug.called)

-    @mock.patch("certbot_apache.parser.ApacheParser.find_dir")
-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.find_dir")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_update_runtime_variables(self, mock_cfg, _):
        define_val = (
            'ServerRoot: "/etc/apache2"\n'
@@ -264,7 +262,7 @@ class BasicParserTest(util.ParserTest):

        self.parser.modules = set()
        with mock.patch(
-            "certbot_apache.parser.ApacheParser.parse_file") as mock_parse:
+            "certbot_apache._internal.parser.ApacheParser.parse_file") as mock_parse:
            self.parser.update_runtime_variables()
            self.assertEqual(self.parser.variables, expected_vars)
            self.assertEqual(len(self.parser.modules), 58)
@@ -272,8 +270,8 @@ class BasicParserTest(util.ParserTest):
            # Make sure we tried to include them all.
            self.assertEqual(mock_parse.call_count, 25)

-    @mock.patch("certbot_apache.parser.ApacheParser.find_dir")
-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.find_dir")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_update_runtime_variables_alt_values(self, mock_cfg, _):
        inc_val = (
            'Included configuration files:\n'
@@ -287,7 +285,7 @@ class BasicParserTest(util.ParserTest):
        self.parser.modules = set()

        with mock.patch(
-            "certbot_apache.parser.ApacheParser.parse_file") as mock_parse:
+            "certbot_apache._internal.parser.ApacheParser.parse_file") as mock_parse:
            self.parser.update_runtime_variables()
            # No matching modules should have been found
            self.assertEqual(len(self.parser.modules), 0)
@@ -295,7 +293,7 @@ class BasicParserTest(util.ParserTest):
            # path derived from root configuration Include statements
            self.assertEqual(mock_parse.call_count, 1)

-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_update_runtime_vars_bad_output(self, mock_cfg):
        mock_cfg.return_value = "Define: TLS=443=24"
        self.parser.update_runtime_variables()
@@ -304,8 +302,8 @@ class BasicParserTest(util.ParserTest):
        self.assertRaises(
            errors.PluginError, self.parser.update_runtime_variables)

-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.option")
-    @mock.patch("certbot_apache.apache_util.subprocess.Popen")
+    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.option")
+    @mock.patch("certbot_apache._internal.parser.subprocess.Popen")
    def test_update_runtime_vars_bad_ctl(self, mock_popen, mock_opt):
        mock_popen.side_effect = OSError
        mock_opt.return_value = "nonexistent"
@@ -313,7 +311,7 @@ class BasicParserTest(util.ParserTest):
            errors.MisconfigurationError,
            self.parser.update_runtime_variables)

-    @mock.patch("certbot_apache.apache_util.subprocess.Popen")
+    @mock.patch("certbot_apache._internal.parser.subprocess.Popen")
    def test_update_runtime_vars_bad_exit(self, mock_popen):
        mock_popen().communicate.return_value = ("", "")
        mock_popen.returncode = -1
@@ -322,7 +320,7 @@ class BasicParserTest(util.ParserTest):
            self.parser.update_runtime_variables)

    def test_add_comment(self):
-        from certbot_apache.parser import get_aug_path
+        from certbot_apache._internal.parser import get_aug_path
        self.parser.add_comment(get_aug_path(self.parser.loc["name"]), "123456")
        comm = self.parser.find_comments("123456")
        self.assertEqual(len(comm), 1)
@@ -338,9 +336,9 @@ class ParserInitTest(util.ApacheTest):
        shutil.rmtree(self.config_dir)
        shutil.rmtree(self.work_dir)

-    @mock.patch("certbot_apache.parser.ApacheParser.init_augeas")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser.init_augeas")
    def test_prepare_no_augeas(self, mock_init_augeas):
-        from certbot_apache.parser import ApacheParser
+        from certbot_apache._internal.parser import ApacheParser
        mock_init_augeas.side_effect = errors.NoInstallationError
        self.config.config_test = mock.Mock()
        self.assertRaises(
@@ -349,17 +347,17 @@ class ParserInitTest(util.ApacheTest):
            version=(2, 4, 22), configurator=self.config)

    def test_init_old_aug(self):
-        from certbot_apache.parser import ApacheParser
-        with mock.patch("certbot_apache.parser.ApacheParser.check_aug_version") as mock_c:
+        from certbot_apache._internal.parser import ApacheParser
+        with mock.patch("certbot_apache._internal.parser.ApacheParser.check_aug_version") as mock_c:
            mock_c.return_value = False
            self.assertRaises(
                errors.NotSupportedError,
                ApacheParser, os.path.relpath(self.config_path),
                "/dummy/vhostpath", version=(2, 4, 22), configurator=self.config)

-    @mock.patch("certbot_apache.apache_util._get_runtime_cfg")
+    @mock.patch("certbot_apache._internal.parser.ApacheParser._get_runtime_cfg")
    def test_unparseable(self, mock_cfg):
-        from certbot_apache.parser import ApacheParser
+        from certbot_apache._internal.parser import ApacheParser
        mock_cfg.return_value = ('Define: TEST')
        self.assertRaises(
            errors.PluginError,
@@ -367,9 +365,9 @@ class ParserInitTest(util.ApacheTest):
            "/dummy/vhostpath", version=(2, 2, 22), configurator=self.config)

    def test_root_normalized(self):
-        from certbot_apache.parser import ApacheParser
+        from certbot_apache._internal.parser import ApacheParser

-        with mock.patch("certbot_apache.parser.ApacheParser."
+        with mock.patch("certbot_apache._internal.parser.ApacheParser."
                        "update_runtime_variables"):
            path = os.path.join(
                self.temp_dir,
@@ -380,8 +378,8 @@ class ParserInitTest(util.ApacheTest):
        self.assertEqual(parser.root, self.config_path)

    def test_root_absolute(self):
-        from certbot_apache.parser import ApacheParser
-        with mock.patch("certbot_apache.parser.ApacheParser."
+        from certbot_apache._internal.parser import ApacheParser
+        with mock.patch("certbot_apache._internal.parser.ApacheParser."
                        "update_runtime_variables"):
            parser = ApacheParser(
                os.path.relpath(self.config_path),
@@ -390,8 +388,8 @@ class ParserInitTest(util.ApacheTest):
        self.assertEqual(parser.root, self.config_path)

    def test_root_no_trailing_slash(self):
-        from certbot_apache.parser import ApacheParser
-        with mock.patch("certbot_apache.parser.ApacheParser."
+        from certbot_apache._internal.parser import ApacheParser
+        with mock.patch("certbot_apache._internal.parser.ApacheParser."
                        "update_runtime_variables"):
            parser = ApacheParser(
                self.config_path + os.path.sep,
--- a/Show More
+++ b/Show More