Add domain and TLS management via skiff domains add/remove/list

Replaces the single server_name string in meta.json with a domain list
(one primary, others redirect to it) and TLSDomains tracking what the
app's certificate actually covers. Certs are issued/expanded via certbot
certonly (webroot, never the --nginx plugin, since Skiff owns and
regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how
a real multi-domain vhost is normally issued.

Domain/TLS changes never touch the jail - no restart, no health check -
since they only affect nginx and the certificate. `add` is safe to retry
if DNS isn't ready yet; `remove` never calls certbot at all, so it can't
fail on an ACME/network problem.

Also updates README/USER_GUIDE for the new command surface, one-time TLS
host setup (certbot register, renewal cron, reload hook), the --ip
same-subnet requirement for jails to reach the network at build time, and
the actual base-image provisioning sequence (pkg needs an explicit
bootstrap after bsdinstall; versioned port names like go125 need a
default symlink) - all found and fixed live while getting this working
end-to-end on a real FreeBSD VM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 128 insertions, 0 deletions

diff --git a/internal/domains/domains.go b/internal/domains/domains.go
new file mode 100644
index 0000000..5bf264f
--- /dev/null
+++ b/internal/domains/domains.go
@@ -0,0 +1,128 @@
+// Package domains manages an app's public hostnames and TLS. Unlike other
+// app config, a domain/cert change never touches the jail, so it skips
+// Skiff's usual snapshot-and-restart safety net entirely.
+package domains
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+
+	"skiff/internal/appmeta"
+	"skiff/internal/certbot"
+	"skiff/internal/layout"
+	"skiff/internal/nginx"
+)
+
+// Add registers hostname for app and syncs routing/TLS. Safe to retry: a
+// DNS-not-ready cert failure just leaves the app on plain HTTP.
+func Add(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string, primary bool) error {
+	meta, err := appmeta.Read(cfg.MetaPath(app))
+	if err != nil {
+		return fmt.Errorf("read app metadata: %w", err)
+	}
+
+	makePrimary := primary || len(meta.Domains) == 0
+	found := false
+	for i := range meta.Domains {
+		if meta.Domains[i].Hostname == hostname {
+			found = true
+			break
+		}
+	}
+	if makePrimary {
+		for i := range meta.Domains {
+			meta.Domains[i].Primary = meta.Domains[i].Hostname == hostname
+		}
+	}
+	if !found {
+		meta.Domains = append(meta.Domains, appmeta.Domain{Hostname: hostname, Primary: makePrimary})
+	}
+
+	if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
+		return fmt.Errorf("write app metadata: %w", err)
+	}
+
+	if err := syncCert(ctx, out, cfg, app, meta); err != nil {
+		return err
+	}
+	fmt.Fprintf(out, "==> %s added for %s\n", hostname, app)
+	return nil
+}
+
+// Remove deregisters hostname and updates routing only - unlike Add, it
+// never calls certbot, so it can't fail or block on it. Removing the
+// primary while others remain is refused - reassign primary first with
+// `skiff domains add --primary`.
+func Remove(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string) error {
+	meta, err := appmeta.Read(cfg.MetaPath(app))
+	if err != nil {
+		return fmt.Errorf("read app metadata: %w", err)
+	}
+
+	idx := -1
+	for i, d := range meta.Domains {
+		if d.Hostname == hostname {
+			idx = i
+			break
+		}
+	}
+	if idx == -1 {
+		return fmt.Errorf("%s is not registered for %s", hostname, app)
+	}
+	if meta.Domains[idx].Primary && len(meta.Domains) > 1 {
+		return fmt.Errorf("%s is %s's primary domain - reassign primary to another domain first (skiff domains add --primary <hostname>)", hostname, app)
+	}
+	meta.Domains = append(meta.Domains[:idx], meta.Domains[idx+1:]...)
+
+	if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
+		return fmt.Errorf("write app metadata: %w", err)
+	}
+
+	if len(meta.Domains) == 0 {
+		if err := nginx.Remove(ctx, out, cfg, app); err != nil {
+			return err
+		}
+	} else if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil {
+		return fmt.Errorf("nginx: %w", err)
+	}
+
+	fmt.Fprintf(out, "==> %s removed from %s\n", hostname, app)
+	return nil
+}
+
+// syncCert routes over plain HTTP first, so a newly added hostname is
+// reachable for the HTTP-01 challenge, then requests/expands the cert and
+// re-routes with TLS enabled for whatever it now covers.
+func syncCert(ctx context.Context, out io.Writer, cfg layout.Config, app string, meta appmeta.Meta) error {
+	primary, ok := meta.PrimaryDomain()
+	if !ok {
+		return fmt.Errorf("%s has domains but none marked primary", app)
+	}
+
+	if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil {
+		return fmt.Errorf("nginx: %w", err)
+	}
+
+	if err := os.MkdirAll(cfg.AcmeWebrootDir, 0755); err != nil {
+		return fmt.Errorf("create acme webroot: %w", err)
+	}
+
+	hostnames := make([]string, len(meta.Domains))
+	for i, d := range meta.Domains {
+		hostnames[i] = d.Hostname
+	}
+
+	fmt.Fprintln(out, "==> requesting certificate")
+	if err := certbot.Sync(ctx, out, cfg.AcmeWebrootDir, primary.Hostname, hostnames); err != nil {
+		return fmt.Errorf("certificate not issued (%w) - fix DNS and re-run this command", err)
+	}
+
+	meta.TLSDomains = hostnames
+	if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
+		return fmt.Errorf("write app metadata: %w", err)
+	}
+
+	return nginx.EnsureRoute(ctx, out, cfg, app, meta)
+}