From 6040eff2d2b4618f19d4615d246ea6b0704acdf8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 21:00:08 -0500 Subject: Add domain and TLS management via skiff domains add/remove/list Replaces the single server_name string in meta.json with a domain list (one primary, others redirect to it) and TLSDomains tracking what the app's certificate actually covers. Certs are issued/expanded via certbot certonly (webroot, never the --nginx plugin, since Skiff owns and regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how a real multi-domain vhost is normally issued. Domain/TLS changes never touch the jail - no restart, no health check - since they only affect nginx and the certificate. `add` is safe to retry if DNS isn't ready yet; `remove` never calls certbot at all, so it can't fail on an ACME/network problem. Also updates README/USER_GUIDE for the new command surface, one-time TLS host setup (certbot register, renewal cron, reload hook), the --ip same-subnet requirement for jails to reach the network at build time, and the actual base-image provisioning sequence (pkg needs an explicit bootstrap after bsdinstall; versioned port names like go125 need a default symlink) - all found and fixed live while getting this working end-to-end on a real FreeBSD VM. Co-Authored-By: Claude Sonnet 5 --- internal/certbot/certbot.go | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 internal/certbot/certbot.go (limited to 'internal/certbot/certbot.go') diff --git a/internal/certbot/certbot.go b/internal/certbot/certbot.go new file mode 100644 index 0000000..3ce5b41 --- /dev/null +++ b/internal/certbot/certbot.go @@ -0,0 +1,26 @@ +// Package certbot issues Let's Encrypt certificates via HTTP-01 webroot +// validation. Deliberately not the --nginx installer plugin - Skiff, not +// certbot, owns and regenerates skiff.d/*.conf. +package certbot + +import ( + "context" + "io" + + "skiff/internal/sh" +) + +// Sync issues or expands the certificate named certName to cover exactly +// domains, via challenge files served from webroot. Idempotent. Assumes +// `certbot register` has already been run once on the host. +func Sync(ctx context.Context, out io.Writer, webroot, certName string, domains []string) error { + args := []string{ + "certonly", "--webroot", "-w", webroot, + "--cert-name", certName, "--expand", + "--non-interactive", "--agree-tos", "--keep-until-expiring", + } + for _, d := range domains { + args = append(args, "-d", d) + } + return sh.Run(ctx, out, "", "certbot", args...) +} -- cgit v1.3