Add domain and TLS management via skiff domains add/remove/list

Replaces the single server_name string in meta.json with a domain list
(one primary, others redirect to it) and TLSDomains tracking what the
app's certificate actually covers. Certs are issued/expanded via certbot
certonly (webroot, never the --nginx plugin, since Skiff owns and
regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how
a real multi-domain vhost is normally issued.

Domain/TLS changes never touch the jail - no restart, no health check -
since they only affect nginx and the certificate. `add` is safe to retry
if DNS isn't ready yet; `remove` never calls certbot at all, so it can't
fail on an ACME/network problem.

Also updates README/USER_GUIDE for the new command surface, one-time TLS
host setup (certbot register, renewal cron, reload hook), the --ip
same-subnet requirement for jails to reach the network at build time, and
the actual base-image provisioning sequence (pkg needs an explicit
bootstrap after bsdinstall; versioned port names like go125 need a
default symlink) - all found and fixed live while getting this working
end-to-end on a real FreeBSD VM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 46 insertions, 7 deletions

diff --git a/internal/nginx/nginx.go b/internal/nginx/nginx.go
index abdd4c9..4a85435 100644
--- a/internal/nginx/nginx.go
+++ b/internal/nginx/nginx.go
@@ -9,19 +9,44 @@ import (
 	"io"
 	"os"
 
+	"skiff/internal/appmeta"
 	"skiff/internal/layout"
 	"skiff/internal/sh"
 	"skiff/internal/tmpl"
 )
 
-// EnsureRoute writes app's vhost file and reloads nginx, but only if the
-// rendered config actually changed - most deploys don't touch routing.
-func EnsureRoute(ctx context.Context, out io.Writer, cfg layout.Config, app, ip string, port int, serverName string) error {
+// EnsureRoute (re)writes app's vhost file from meta and reloads nginx, but
+// only if the rendered config changed. A hostname gets HTTPS only once it's
+// in both meta.Domains and meta.TLSDomains. No domains yet is a no-op.
+func EnsureRoute(ctx context.Context, out io.Writer, cfg layout.Config, app string, meta appmeta.Meta) error {
+	if len(meta.Domains) == 0 {
+		fmt.Fprintf(out, "==> no domains configured for %s, skipping nginx route\n", app)
+		return nil
+	}
+	primary, ok := meta.PrimaryDomain()
+	if !ok {
+		return fmt.Errorf("%s has domains but none marked primary", app)
+	}
+
+	live := make(map[string]bool, len(meta.TLSDomains))
+	for _, h := range meta.TLSDomains {
+		live[h] = true
+	}
+
+	doms := make([]tmpl.NginxDomain, len(meta.Domains))
+	for i, d := range meta.Domains {
+		doms[i] = tmpl.NginxDomain{Hostname: d.Hostname, Primary: d.Primary, CertLive: live[d.Hostname]}
+	}
+
 	rendered, err := tmpl.NginxApp(tmpl.NginxAppData{
-		Name:       app,
-		IP:         ip,
-		Port:       port,
-		ServerName: serverName,
+		Name:            app,
+		IP:              meta.IP,
+		Port:            meta.Port,
+		Webroot:         cfg.AcmeWebrootDir,
+		PrimaryHostname: primary.Hostname,
+		PrimaryCertLive: live[primary.Hostname],
+		PrimaryLiveDir:  cfg.LetsEncryptLiveDir(primary.Hostname),
+		Domains:         doms,
 	})
 	if err != nil {
 		return err
@@ -40,6 +65,20 @@ func EnsureRoute(ctx context.Context, out io.Writer, cfg layout.Config, app, ip
 	return Reload(ctx, out)
 }
 
+// Remove deletes app's vhost file entirely and reloads - used once its last
+// domain is removed, since there's nothing left to route.
+func Remove(ctx context.Context, out io.Writer, cfg layout.Config, app string) error {
+	path := cfg.NginxConfPath(app)
+	if err := os.Remove(path); err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return fmt.Errorf("remove nginx conf for %s: %w", app, err)
+	}
+	fmt.Fprintf(out, "==> nginx route removed for %s, reloading\n", app)
+	return Reload(ctx, out)
+}
+
 func Reload(ctx context.Context, out io.Writer) error {
 	return sh.Run(ctx, out, "", "nginx", "-s", "reload")
 }