Add domain and TLS management via skiff domains add/remove/list

Replaces the single server_name string in meta.json with a domain list
(one primary, others redirect to it) and TLSDomains tracking what the
app's certificate actually covers. Certs are issued/expanded via certbot
certonly (webroot, never the --nginx plugin, since Skiff owns and
regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how
a real multi-domain vhost is normally issued.

Domain/TLS changes never touch the jail - no restart, no health check -
since they only affect nginx and the certificate. `add` is safe to retry
if DNS isn't ready yet; `remove` never calls certbot at all, so it can't
fail on an ACME/network problem.

Also updates README/USER_GUIDE for the new command surface, one-time TLS
host setup (certbot register, renewal cron, reload hook), the --ip
same-subnet requirement for jails to reach the network at build time, and
the actual base-image provisioning sequence (pkg needs an explicit
bootstrap after bsdinstall; versioned port names like go125 need a
default symlink) - all found and fixed live while getting this working
end-to-end on a real FreeBSD VM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/internal/layout/layout.go b/internal/layout/layout.go
index 5ac6c26..f350efb 100644
--- a/internal/layout/layout.go
+++ b/internal/layout/layout.go
@@ -24,6 +24,9 @@ type Config struct {
 	JailConfDir  string // /etc/jail.conf.d
 	NginxConfDir string // nginx include dir regenerated on every deploy
 	LocksDir     string // per-app flock files live here, outside any per-app dataset
+
+	AcmeWebrootDir string // static dir nginx serves ACME HTTP-01 challenge files from, shared by every app
+	LetsEncryptDir string // certbot's own state dir
 }
 
 func Default() Config {
@@ -35,6 +38,9 @@ func Default() Config {
 		JailConfDir:  "/etc/jail.conf.d",
 		NginxConfDir: "/usr/local/etc/nginx/skiff.d",
 		LocksDir:     "/skiff/locks",
+
+		AcmeWebrootDir: "/skiff/acme-challenge",
+		LetsEncryptDir: "/usr/local/etc/letsencrypt",
 	}
 }
 
@@ -78,6 +84,13 @@ func (c Config) NginxConfPath(app string) string {
 	return filepath.Join(c.NginxConfDir, app+".conf")
 }
 
+// LetsEncryptLiveDir is where certbot writes the live cert/key for a
+// certificate named certName (Skiff always names one after its app's
+// primary domain).
+func (c Config) LetsEncryptLiveDir(certName string) string {
+	return filepath.Join(c.LetsEncryptDir, "live", certName)
+}
+
 func (c Config) PostReceiveHookPath(app string) string {
 	return filepath.Join(c.RepoPath(app), "hooks", "post-receive")
 }