From 6040eff2d2b4618f19d4615d246ea6b0704acdf8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 21:00:08 -0500 Subject: Add domain and TLS management via skiff domains add/remove/list Replaces the single server_name string in meta.json with a domain list (one primary, others redirect to it) and TLSDomains tracking what the app's certificate actually covers. Certs are issued/expanded via certbot certonly (webroot, never the --nginx plugin, since Skiff owns and regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how a real multi-domain vhost is normally issued. Domain/TLS changes never touch the jail - no restart, no health check - since they only affect nginx and the certificate. `add` is safe to retry if DNS isn't ready yet; `remove` never calls certbot at all, so it can't fail on an ACME/network problem. Also updates README/USER_GUIDE for the new command surface, one-time TLS host setup (certbot register, renewal cron, reload hook), the --ip same-subnet requirement for jails to reach the network at build time, and the actual base-image provisioning sequence (pkg needs an explicit bootstrap after bsdinstall; versioned port names like go125 need a default symlink) - all found and fixed live while getting this working end-to-end on a real FreeBSD VM. Co-Authored-By: Claude Sonnet 5 --- internal/domains/domains.go | 128 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 128 insertions(+) create mode 100644 internal/domains/domains.go (limited to 'internal/domains/domains.go') diff --git a/internal/domains/domains.go b/internal/domains/domains.go new file mode 100644 index 0000000..5bf264f --- /dev/null +++ b/internal/domains/domains.go @@ -0,0 +1,128 @@ +// Package domains manages an app's public hostnames and TLS. Unlike other +// app config, a domain/cert change never touches the jail, so it skips +// Skiff's usual snapshot-and-restart safety net entirely. +package domains + +import ( + "context" + "fmt" + "io" + "os" + + "skiff/internal/appmeta" + "skiff/internal/certbot" + "skiff/internal/layout" + "skiff/internal/nginx" +) + +// Add registers hostname for app and syncs routing/TLS. Safe to retry: a +// DNS-not-ready cert failure just leaves the app on plain HTTP. +func Add(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string, primary bool) error { + meta, err := appmeta.Read(cfg.MetaPath(app)) + if err != nil { + return fmt.Errorf("read app metadata: %w", err) + } + + makePrimary := primary || len(meta.Domains) == 0 + found := false + for i := range meta.Domains { + if meta.Domains[i].Hostname == hostname { + found = true + break + } + } + if makePrimary { + for i := range meta.Domains { + meta.Domains[i].Primary = meta.Domains[i].Hostname == hostname + } + } + if !found { + meta.Domains = append(meta.Domains, appmeta.Domain{Hostname: hostname, Primary: makePrimary}) + } + + if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil { + return fmt.Errorf("write app metadata: %w", err) + } + + if err := syncCert(ctx, out, cfg, app, meta); err != nil { + return err + } + fmt.Fprintf(out, "==> %s added for %s\n", hostname, app) + return nil +} + +// Remove deregisters hostname and updates routing only - unlike Add, it +// never calls certbot, so it can't fail or block on it. Removing the +// primary while others remain is refused - reassign primary first with +// `skiff domains add --primary`. +func Remove(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string) error { + meta, err := appmeta.Read(cfg.MetaPath(app)) + if err != nil { + return fmt.Errorf("read app metadata: %w", err) + } + + idx := -1 + for i, d := range meta.Domains { + if d.Hostname == hostname { + idx = i + break + } + } + if idx == -1 { + return fmt.Errorf("%s is not registered for %s", hostname, app) + } + if meta.Domains[idx].Primary && len(meta.Domains) > 1 { + return fmt.Errorf("%s is %s's primary domain - reassign primary to another domain first (skiff domains add --primary )", hostname, app) + } + meta.Domains = append(meta.Domains[:idx], meta.Domains[idx+1:]...) + + if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil { + return fmt.Errorf("write app metadata: %w", err) + } + + if len(meta.Domains) == 0 { + if err := nginx.Remove(ctx, out, cfg, app); err != nil { + return err + } + } else if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil { + return fmt.Errorf("nginx: %w", err) + } + + fmt.Fprintf(out, "==> %s removed from %s\n", hostname, app) + return nil +} + +// syncCert routes over plain HTTP first, so a newly added hostname is +// reachable for the HTTP-01 challenge, then requests/expands the cert and +// re-routes with TLS enabled for whatever it now covers. +func syncCert(ctx context.Context, out io.Writer, cfg layout.Config, app string, meta appmeta.Meta) error { + primary, ok := meta.PrimaryDomain() + if !ok { + return fmt.Errorf("%s has domains but none marked primary", app) + } + + if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil { + return fmt.Errorf("nginx: %w", err) + } + + if err := os.MkdirAll(cfg.AcmeWebrootDir, 0755); err != nil { + return fmt.Errorf("create acme webroot: %w", err) + } + + hostnames := make([]string, len(meta.Domains)) + for i, d := range meta.Domains { + hostnames[i] = d.Hostname + } + + fmt.Fprintln(out, "==> requesting certificate") + if err := certbot.Sync(ctx, out, cfg.AcmeWebrootDir, primary.Hostname, hostnames); err != nil { + return fmt.Errorf("certificate not issued (%w) - fix DNS and re-run this command", err) + } + + meta.TLSDomains = hostnames + if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil { + return fmt.Errorf("write app metadata: %w", err) + } + + return nginx.EnsureRoute(ctx, out, cfg, app, meta) +} -- cgit v1.3