From 6040eff2d2b4618f19d4615d246ea6b0704acdf8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 21:00:08 -0500 Subject: Add domain and TLS management via skiff domains add/remove/list Replaces the single server_name string in meta.json with a domain list (one primary, others redirect to it) and TLSDomains tracking what the app's certificate actually covers. Certs are issued/expanded via certbot certonly (webroot, never the --nginx plugin, since Skiff owns and regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how a real multi-domain vhost is normally issued. Domain/TLS changes never touch the jail - no restart, no health check - since they only affect nginx and the certificate. `add` is safe to retry if DNS isn't ready yet; `remove` never calls certbot at all, so it can't fail on an ACME/network problem. Also updates README/USER_GUIDE for the new command surface, one-time TLS host setup (certbot register, renewal cron, reload hook), the --ip same-subnet requirement for jails to reach the network at build time, and the actual base-image provisioning sequence (pkg needs an explicit bootstrap after bsdinstall; versioned port names like go125 need a default symlink) - all found and fixed live while getting this working end-to-end on a real FreeBSD VM. Co-Authored-By: Claude Sonnet 5 --- internal/appmeta/appmeta.go | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) (limited to 'internal/appmeta/appmeta.go') diff --git a/internal/appmeta/appmeta.go b/internal/appmeta/appmeta.go index 61ceb18..72c8afc 100644 --- a/internal/appmeta/appmeta.go +++ b/internal/appmeta/appmeta.go @@ -1,7 +1,7 @@ // Package appmeta stores the small amount of per-app networking config -// Skiff itself needs (IP, port, health check) that isn't already implied by -// jail.conf/rc.conf - a flat file living with the app's own data, not a -// separate control-plane database. +// Skiff itself needs (IP, port, health check, domains) that isn't already +// implied by jail.conf/rc.conf - a flat file living with the app's own +// data, not a separate control-plane database. package appmeta import ( @@ -9,11 +9,30 @@ import ( "os" ) +// Domain is one hostname routed to the app; every non-Primary one redirects +// to whichever is Primary. +type Domain struct { + Hostname string `json:"hostname"` + Primary bool `json:"primary"` +} + type Meta struct { - IP string `json:"ip"` - Port int `json:"port"` - HealthPath string `json:"health_path"` - ServerName string `json:"server_name"` + IP string `json:"ip"` + Port int `json:"port"` + HealthPath string `json:"health_path"` + Domains []Domain `json:"domains,omitempty"` + // Hostnames the app's cert actually covers as of the last sync - may + // lag Domains after an add (not yet issued) or a remove (not pruned). + TLSDomains []string `json:"tls_domains,omitempty"` +} + +func (m Meta) PrimaryDomain() (Domain, bool) { + for _, d := range m.Domains { + if d.Primary { + return d, true + } + } + return Domain{}, false } func Write(path string, m Meta) error { -- cgit v1.3