Add external snap docs and clean up dev docs (#8356)

* Add external snap docs and clean up dev docs

* Correctly refer to content identifiers

* Expand plugin interface docs and add line breaks

tools/snap/README.md

@@ -1,58 +1,6 @@
-# Certbot Plugin Snaps
+# Certbot Snaps
 
-This is a proof of concept of how a Certbot snap might support plugin snaps
-that add functionality to Certbot using its existing plugin API.
-
-## Architecture
-
-This is a description of how Certbot plugin functionality is exposed via snaps.
-For information on Certbot's plugin architecture itself, see the [Certbot
-documentation on
-plugins](https://certbot.eff.org/docs/contributing.html#plugin-architecture).
-
-The Certbot snap itself is a classic snap. Plugin snaps are regular confined
-snaps, but normally do not provide any "apps" themselves. Plugin snaps export
-loadable Python modules to the Certbot snap via a snap content interface.
-
-Certbot itself accepts a `CERTBOT_PLUGIN_PATH` environment variable. This
-support is currently patched but this is intended to be upstreamed. The
-variable, if set, should contain a `:`-separated list of paths to add to
-Certbot's plugin search path.
-
-The Certbot snap runs Certbot via a wrapper which examines its list of
-connected interfaces, sets `CERTBOT_PLUGIN_PATH` accordingly, and then `exec`s
-Certbot itself.
-
-## Use (Production)
-
-_Note: this production use example assumes that these snaps are available in
-stable channels in the Snap Store, which they aren't yet. See below for
-development instructions._
-
-To use a Certbot plugin snap, install both the plugin snap and the Certbot snap
-as usual. Plugin snaps are confined as normal; the Certbot snap is a classic
-snap and thus needs `--classic` during installation. For example:
-
-    snap install --classic certbot
-    snap set certbot trust-plugin-with-root=ok
-    snap install certbot-dns-dnsimple
-
-Then connect the plugin snap to the main certbot snap as follows. Note that
-this connection allows the plugin snap code to run inside the certbot process,
-which has access to your host system. Only perform this step if you trust the
-plugin author to have "root" on your system.
-
-    sudo snap connect certbot:plugin certbot-dns-dnsimple
-
-Now certbot will automatically load and use the plugin when it is run. To check
-that this has worked, `certbot plugins` should list the plugin.
-
-You can now operate the plugin as normal.
-
-## Use (Testing and Development)
-
-To try this out, you'll need to build the snaps (a patched Certbot snap and a
-plugin snap) manually.
+## Local Testing and Development
 
 ### Initial VM Set Up
 
@@ -95,25 +43,3 @@ The instructions below clean up the build environment so it can reliably be used
 5. `rm certbot-dns-dnsimple_*_amd64.snap`
 6. `snapcraft clean --use-lxd`
 7. `cd ..`
-
-## Publishing Permissions
-
-There are security implications to permitting anyone to publish, without
-review, a plugin into the Snap Store which will then run in Certbot's classic
-snap context, with full access to the host system.
-
-At a minimum, it is clear that this should happen only with the user's explicit
-opt-in action.
-
-As implemented, Certbot will only load plugins connected via the snap interface
-mechanism, so permission is effectively delegated to what interface connections
-the snap infrastucture will permit.
-
-We have approval from the snap team to use this design as long as we make it
-explicit what a user is agreeing to when they connect a plugin to the
-Certbot snap. That work was completed in
-https://github.com/certbot/certbot/issues/8013.
-
-## Outstanding issues
-
-[Outstanding items relating to plugin support in Certbot snaps are tracked on GitHub](https://github.com/certbot/certbot/issues?q=is%3Aopen+is%3Aissue+label%3A%22area%3A+snaps%22).