|
Replaces the single server_name string in meta.json with a domain list
(one primary, others redirect to it) and TLSDomains tracking what the
app's certificate actually covers. Certs are issued/expanded via certbot
certonly (webroot, never the --nginx plugin, since Skiff owns and
regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how
a real multi-domain vhost is normally issued.
Domain/TLS changes never touch the jail - no restart, no health check -
since they only affect nginx and the certificate. `add` is safe to retry
if DNS isn't ready yet; `remove` never calls certbot at all, so it can't
fail on an ACME/network problem.
Also updates README/USER_GUIDE for the new command surface, one-time TLS
host setup (certbot register, renewal cron, reload hook), the --ip
same-subnet requirement for jails to reach the network at build time, and
the actual base-image provisioning sequence (pkg needs an explicit
bootstrap after bsdinstall; versioned port names like go125 need a
default symlink) - all found and fixed live while getting this working
end-to-end on a real FreeBSD VM.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
Two provisioning gaps in new-app:
- The jail's dma.conf inherited the base image's shared SMARTHOST/
PORT/AUTHPATH, but never got a per-app MAILNAME - without one, dma
can misroute mail for recipients on the jail's own apex domain as
local delivery. EnableMail appends a MAILNAME of <app>.skiff.local,
which can't collide with any real domain an app sends to or from.
- A classic jail's ip4.addr is only a bind restriction, not a route,
until something aliases it onto a host interface. jail.conf.tmpl
never set jail(8)'s own `interface` parameter, so nothing ever
created that alias - confirmed on skiff-freebsd, where the address
had twice been made to work via an ad hoc `ifconfig alias` that
didn't survive a reboot. Setting `interface` lets jail(8) manage
the alias itself, including on every boot.
|
