Add domain and TLS management via skiff domains add/remove/list

Replaces the single server_name string in meta.json with a domain list
(one primary, others redirect to it) and TLSDomains tracking what the
app's certificate actually covers. Certs are issued/expanded via certbot
certonly (webroot, never the --nginx plugin, since Skiff owns and
regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how
a real multi-domain vhost is normally issued.

Domain/TLS changes never touch the jail - no restart, no health check -
since they only affect nginx and the certificate. `add` is safe to retry
if DNS isn't ready yet; `remove` never calls certbot at all, so it can't
fail on an ACME/network problem.

Also updates README/USER_GUIDE for the new command surface, one-time TLS
host setup (certbot register, renewal cron, reload hook), the --ip
same-subnet requirement for jails to reach the network at build time, and
the actual base-image provisioning sequence (pkg needs an explicit
bootstrap after bsdinstall; versioned port names like go125 need a
default symlink) - all found and fixed live while getting this working
end-to-end on a real FreeBSD VM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 26 insertions, 7 deletions

diff --git a/internal/appmeta/appmeta.go b/internal/appmeta/appmeta.go
index 61ceb18..72c8afc 100644
--- a/internal/appmeta/appmeta.go
+++ b/internal/appmeta/appmeta.go
@@ -1,7 +1,7 @@
 // Package appmeta stores the small amount of per-app networking config
-// Skiff itself needs (IP, port, health check) that isn't already implied by
-// jail.conf/rc.conf - a flat file living with the app's own data, not a
-// separate control-plane database.
+// Skiff itself needs (IP, port, health check, domains) that isn't already
+// implied by jail.conf/rc.conf - a flat file living with the app's own
+// data, not a separate control-plane database.
 package appmeta
 
 import (
@@ -9,11 +9,30 @@ import (
 	"os"
 )
 
+// Domain is one hostname routed to the app; every non-Primary one redirects
+// to whichever is Primary.
+type Domain struct {
+	Hostname string `json:"hostname"`
+	Primary  bool   `json:"primary"`
+}
+
 type Meta struct {
-	IP         string `json:"ip"`
-	Port       int    `json:"port"`
-	HealthPath string `json:"health_path"`
-	ServerName string `json:"server_name"`
+	IP         string   `json:"ip"`
+	Port       int      `json:"port"`
+	HealthPath string   `json:"health_path"`
+	Domains    []Domain `json:"domains,omitempty"`
+	// Hostnames the app's cert actually covers as of the last sync - may
+	// lag Domains after an add (not yet issued) or a remove (not pruned).
+	TLSDomains []string `json:"tls_domains,omitempty"`
+}
+
+func (m Meta) PrimaryDomain() (Domain, bool) {
+	for _, d := range m.Domains {
+		if d.Primary {
+			return d, true
+		}
+	}
+	return Domain{}, false
 }
 
 func Write(path string, m Meta) error {