From 6040eff2d2b4618f19d4615d246ea6b0704acdf8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 21:00:08 -0500 Subject: Add domain and TLS management via skiff domains add/remove/list Replaces the single server_name string in meta.json with a domain list (one primary, others redirect to it) and TLSDomains tracking what the app's certificate actually covers. Certs are issued/expanded via certbot certonly (webroot, never the --nginx plugin, since Skiff owns and regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how a real multi-domain vhost is normally issued. Domain/TLS changes never touch the jail - no restart, no health check - since they only affect nginx and the certificate. `add` is safe to retry if DNS isn't ready yet; `remove` never calls certbot at all, so it can't fail on an ACME/network problem. Also updates README/USER_GUIDE for the new command surface, one-time TLS host setup (certbot register, renewal cron, reload hook), the --ip same-subnet requirement for jails to reach the network at build time, and the actual base-image provisioning sequence (pkg needs an explicit bootstrap after bsdinstall; versioned port names like go125 need a default symlink) - all found and fixed live while getting this working end-to-end on a real FreeBSD VM. Co-Authored-By: Claude Sonnet 5 --- internal/layout/layout.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'internal/layout/layout.go') diff --git a/internal/layout/layout.go b/internal/layout/layout.go index 5ac6c26..f350efb 100644 --- a/internal/layout/layout.go +++ b/internal/layout/layout.go @@ -24,6 +24,9 @@ type Config struct { JailConfDir string // /etc/jail.conf.d NginxConfDir string // nginx include dir regenerated on every deploy LocksDir string // per-app flock files live here, outside any per-app dataset + + AcmeWebrootDir string // static dir nginx serves ACME HTTP-01 challenge files from, shared by every app + LetsEncryptDir string // certbot's own state dir } func Default() Config { @@ -35,6 +38,9 @@ func Default() Config { JailConfDir: "/etc/jail.conf.d", NginxConfDir: "/usr/local/etc/nginx/skiff.d", LocksDir: "/skiff/locks", + + AcmeWebrootDir: "/skiff/acme-challenge", + LetsEncryptDir: "/usr/local/etc/letsencrypt", } } @@ -78,6 +84,13 @@ func (c Config) NginxConfPath(app string) string { return filepath.Join(c.NginxConfDir, app+".conf") } +// LetsEncryptLiveDir is where certbot writes the live cert/key for a +// certificate named certName (Skiff always names one after its app's +// primary domain). +func (c Config) LetsEncryptLiveDir(certName string) string { + return filepath.Join(c.LetsEncryptDir, "live", certName) +} + func (c Config) PostReceiveHookPath(app string) string { return filepath.Join(c.RepoPath(app), "hooks", "post-receive") } -- cgit v1.3