From 6040eff2d2b4618f19d4615d246ea6b0704acdf8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 21:00:08 -0500 Subject: Add domain and TLS management via skiff domains add/remove/list Replaces the single server_name string in meta.json with a domain list (one primary, others redirect to it) and TLSDomains tracking what the app's certificate actually covers. Certs are issued/expanded via certbot certonly (webroot, never the --nginx plugin, since Skiff owns and regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how a real multi-domain vhost is normally issued. Domain/TLS changes never touch the jail - no restart, no health check - since they only affect nginx and the certificate. `add` is safe to retry if DNS isn't ready yet; `remove` never calls certbot at all, so it can't fail on an ACME/network problem. Also updates README/USER_GUIDE for the new command surface, one-time TLS host setup (certbot register, renewal cron, reload hook), the --ip same-subnet requirement for jails to reach the network at build time, and the actual base-image provisioning sequence (pkg needs an explicit bootstrap after bsdinstall; versioned port names like go125 need a default symlink) - all found and fixed live while getting this working end-to-end on a real FreeBSD VM. Co-Authored-By: Claude Sonnet 5 --- internal/tmpl/nginx-app.conf.tmpl | 38 ++++++++++++++++++++++++++++++++++++-- internal/tmpl/tmpl.go | 21 +++++++++++++++++---- 2 files changed, 53 insertions(+), 6 deletions(-) (limited to 'internal/tmpl') diff --git a/internal/tmpl/nginx-app.conf.tmpl b/internal/tmpl/nginx-app.conf.tmpl index b55a332..66ce0d5 100644 --- a/internal/tmpl/nginx-app.conf.tmpl +++ b/internal/tmpl/nginx-app.conf.tmpl @@ -2,14 +2,48 @@ upstream {{.Name}}_upstream { server {{.IP}}:{{.Port}}; } +{{range .Domains}} server { listen 80; - server_name {{.ServerName}}; + server_name {{.Hostname}}; + + location ^~ /.well-known/acme-challenge/ { + root {{$.Webroot}}; + } + + location / { +{{if .CertLive}} + return 301 https://{{$.PrimaryHostname}}$request_uri; +{{else if .Primary}} + proxy_pass http://{{$.Name}}_upstream; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; +{{else if $.PrimaryCertLive}} + return 301 https://{{$.PrimaryHostname}}$request_uri; +{{else}} + return 301 http://{{$.PrimaryHostname}}$request_uri; +{{end}} + } +} +{{if .CertLive}} +server { + listen 443 ssl; + server_name {{.Hostname}}; + + ssl_certificate {{$.PrimaryLiveDir}}/fullchain.pem; + ssl_certificate_key {{$.PrimaryLiveDir}}/privkey.pem; location / { - proxy_pass http://{{.Name}}_upstream; +{{if .Primary}} + proxy_pass http://{{$.Name}}_upstream; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; +{{else}} + return 301 https://{{$.PrimaryHostname}}$request_uri; +{{end}} } } +{{end}} +{{end}} diff --git a/internal/tmpl/tmpl.go b/internal/tmpl/tmpl.go index 12baa70..0213919 100644 --- a/internal/tmpl/tmpl.go +++ b/internal/tmpl/tmpl.go @@ -46,11 +46,24 @@ type RCData struct{ Name string } func RCScript(d RCData) (string, error) { return Render(rcScript, d) } +// NginxDomain is one hostname in an app's vhost. CertLive gates HTTPS. +type NginxDomain struct { + Hostname string + Primary bool + CertLive bool +} + type NginxAppData struct { - Name string - IP string - Port int - ServerName string + Name string + IP string + Port int + Webroot string // ACME HTTP-01 challenge webroot, shared across apps + + PrimaryHostname string + PrimaryCertLive bool + PrimaryLiveDir string // certbot's live dir for the app's shared cert + + Domains []NginxDomain } func NginxApp(d NginxAppData) (string, error) { return Render(nginxApp, d) } -- cgit v1.3