@serve.zone/dcrouter 17.10.2 → 18.0.0

package/ts/dns/manager.dns.ts

@@ -18,6 +18,28 @@ import type {
   IDnsProviderPublic,
   IProviderDomainListing,
 } from '../../ts_interfaces/data/dns-provider.js';
+import {
+  resolveDomainOwnership,
+  type IDomainOwnershipZone,
+  type TDomainOwnership,
+} from './domain-ownership.js';
+
+/**
+ * Where a runtime DnsServer handler came from.
+ *
+ * - 'persisted' → rebuilt from a DnsRecordDoc row.
+ * - 'generated-default' → synthesised by dcrouter (apex NS today; SOA and other
+ *   zone defaults would join this origin), so it has no DB row to enumerate and
+ *   must be torn down from the registry.
+ */
+export type TDnsRuntimeRegistrationOrigin = 'persisted' | 'generated-default';
+
+/** One runtime DnsServer handler key owned by a DomainDoc. */
+export interface IDnsRuntimeRegistration {
+  name: string;
+  type: TDnsRecordType;
+  origin: TDnsRuntimeRegistrationOrigin;
+}
 
 /**
  * DnsManager — owns runtime DNS state on top of the embedded DnsServer.
@@ -36,7 +58,7 @@ import type {
 export class DnsManager {
   /**
    * Reference to the active smartdns DnsServer (set by DcRouter once it exists).
-   * May be undefined if dnsScopes/dnsNsDomains aren't configured.
+   * May be undefined if dnsNsDomains isn't configured.
    */
   public dnsServer?: plugins.smartdns.dnsServerMod.DnsServer;
 
@@ -46,8 +68,94 @@ export class DnsManager {
    */
   private providerClients = new Map<string, IDnsProviderClient>();
 
+  /**
+   * Per-domain registry of the runtime DnsServer handlers this manager owns,
+   * keyed by DomainDoc.id then by `name|type`.
+   *
+   * Teardown must remove exactly what registration added — no more, no less.
+   * smartdns' `unregisterHandler(pattern, types)` removes *every* handler for a
+   * pattern/type pair, including the nameserver glue handlers owned by
+   * DnsServerRuntime and the global wildcard A handler. Reconstructing "would I
+   * have registered this?" at delete time is therefore unsafe: any drift in the
+   * inputs (authority changed, ownership changed, a record row vanished) makes the
+   * reconstruction tear down another owner's handlers or miss its own. Recording
+   * the actual registrations, with their origin, removes that class of bug.
+   */
+  private runtimeRegistrations = new Map<string, Map<string, IDnsRuntimeRegistration>>();
+
+  /** Supplies the effective authority set (bootstrap ∪ delegation-verified). */
+  private authorityZonesResolver?: () => string[];
+
   constructor(private options: IDcRouterOptions) {}
 
+  // ==========================================================================
+  // Runtime registration registry
+  // ==========================================================================
+
+  private trackRuntimeRegistration(
+    domainId: string,
+    name: string,
+    type: TDnsRecordType,
+    origin: TDnsRuntimeRegistrationOrigin,
+  ): void {
+    let owned = this.runtimeRegistrations.get(domainId);
+    if (!owned) {
+      owned = new Map<string, IDnsRuntimeRegistration>();
+      this.runtimeRegistrations.set(domainId, owned);
+    }
+    owned.set(this.rrsetKey(name, type), { name: name.toLowerCase(), type, origin });
+  }
+
+  private untrackRuntimeRegistration(
+    domainId: string,
+    name: string,
+    type: TDnsRecordType,
+  ): void {
+    const owned = this.runtimeRegistrations.get(domainId);
+    if (!owned) return;
+    owned.delete(this.rrsetKey(name, type));
+    if (owned.size === 0) {
+      this.runtimeRegistrations.delete(domainId);
+    }
+  }
+
+  /** Registrations currently owned by a domain. Exposed for teardown assertions. */
+  public listRuntimeRegistrations(domainId: string): IDnsRuntimeRegistration[] {
+    return [...(this.runtimeRegistrations.get(domainId)?.values() || [])];
+  }
+
+  /**
+   * Unregister every runtime handler owned by a domain and forget them.
+   *
+   * Called from every path that ends dcrouter's authority over a zone. Without
+   * it, deleting a DomainDoc removed the DB source of truth (so record queries
+   * started answering REFUSED) while the generated apex NS handler kept answering
+   * `aa` with our nameservers until the process was restarted — stale authority
+   * live in memory, with nothing telling the next operator to restart. A restart
+   * is not an acceptable delete procedure: it costs 30–60 s of total public
+   * outage.
+   */
+  private tearDownDomainRuntimeRegistrations(domainId: string): void {
+    const owned = this.runtimeRegistrations.get(domainId);
+    this.runtimeRegistrations.delete(domainId);
+    if (!owned || !this.dnsServer) {
+      return;
+    }
+    const generatedZones: string[] = [];
+    for (const registration of owned.values()) {
+      this.dnsServer.unregisterHandler(registration.name, [registration.type]);
+      if (registration.origin === 'generated-default') {
+        generatedZones.push(`${registration.name} ${registration.type}`);
+      }
+    }
+    logger.log(
+      'info',
+      `DnsManager: unregistered ${owned.size} runtime DNS handler key(s) for domain ${domainId}`
+        + (generatedZones.length ? `, including generated default(s) ${generatedZones.join(', ')}` : ''),
+      { zone: 'dns', domainId },
+    );
+  }
+
   // ==========================================================================
   // Lifecycle
   // ==========================================================================
@@ -58,6 +166,7 @@ export class DnsManager {
 
   public async stop(): Promise<void> {
     this.providerClients.clear();
+    this.runtimeRegistrations.clear();
     this.dnsServer = undefined;
   }
 
@@ -84,6 +193,12 @@ export class DnsManager {
       return;
     }
     const allDomains = await DomainDoc.findAll();
+    // One ownership snapshot for the whole startup pass, not one scan per zone.
+    const ownershipZones: IDomainOwnershipZone[] = allDomains.map((domainArg) => ({
+      name: domainArg.name,
+      source: domainArg.source,
+      providerId: domainArg.providerId,
+    }));
     const dcrouterDomains = allDomains.filter((d) => d.source === 'dcrouter');
     let registered = 0;
     for (const domain of dcrouterDomains) {
@@ -94,7 +209,7 @@ export class DnsManager {
         await this.refreshLocalRrset(domain.id, name, type);
       }
       registered += records.length;
-      await this.registerAuthoritativeZoneDefaults(domain);
+      await this.registerAuthoritativeZoneDefaults(domain, ownershipZones);
     }
     logger.log(
       'info',
@@ -104,12 +219,22 @@ export class DnsManager {
 
   /**
    * Authoritative zones must answer apex NS queries or their delegation is
-   * lame — Let's Encrypt's DNS-01 resolver SERVFAILs on such zones. Static
-   * dnsScopes zones get NS records in DnsServerRuntime; zones registered in
-   * the DB get them here, served from options.dnsNsDomains unless explicit
-   * apex NS records exist in the DB.
+   * lame — Let's Encrypt's DNS-01 resolver SERVFAILs on such zones. This is the
+   * only place generated apex NS records come from, for every authoritative
+   * zone: they are served from options.dnsNsDomains unless explicit apex NS
+   * records exist in the DB. DnsServerRuntime used to emit a static set for
+   * bootstrap `dnsScopes` zones, which could neither appear for a zone verified
+   * after startup nor disappear for one whose authority was revoked.
+   *
+   * Ownership is verified first. smartdns marks any answer a registered handler
+   * produces as authoritative (`aa`) regardless of `authoritativeZones`, so
+   * registering this handler for a zone we cannot prove we own makes dcrouter
+   * publicly claim authority over somebody else's domain.
    */
-  private async registerAuthoritativeZoneDefaults(domain: DomainDoc): Promise<void> {
+  private async registerAuthoritativeZoneDefaults(
+    domain: DomainDoc,
+    ownershipZonesArg?: IDomainOwnershipZone[],
+  ): Promise<void> {
     if (!this.dnsServer) {
       return;
     }
@@ -118,10 +243,29 @@ export class DnsManager {
       return;
     }
     const zoneName = domain.name.toLowerCase();
-    // Static dnsScopes zones already get apex NS records from DnsServerRuntime.
-    if (this.options.dnsScopes?.includes(zoneName)) {
+    // Already serving this zone's generated apex NS — do not stack duplicate handlers.
+    if (this.runtimeRegistrations.get(domain.id)?.get(this.rrsetKey(zoneName, 'NS'))?.origin
+      === 'generated-default') {
       return;
     }
+
+    const ownership = ownershipZonesArg
+      ? resolveDomainOwnership({
+          fqdn: zoneName,
+          zones: ownershipZonesArg,
+          authorityZones: this.getAuthorityZones(),
+        })
+      : await this.resolveDomainOwnership(zoneName);
+    if (!ownership.verified) {
+      logger.log(
+        'error',
+        `DnsManager: refusing to serve authoritative apex NS records for ${zoneName} — ${ownership.detail}. `
+          + 'dcrouter answers with the aa flag for every handler it registers, so this zone stays unserved (REFUSED) until ownership is verified.',
+        { zone: 'dns', domainId: domain.id, ownershipReason: ownership.reason },
+      );
+      return;
+    }
+
     const existingRecords = await DnsRecordDoc.findByDomainId(domain.id);
     const hasExplicitApexNs = existingRecords.some(
       (rec) => rec.type === 'NS' && rec.name.toLowerCase() === zoneName,
@@ -143,12 +287,165 @@ export class DnsManager {
         return null;
       });
     }
+    this.trackRuntimeRegistration(domain.id, zoneName, 'NS', 'generated-default');
     logger.log(
       'info',
-      `DnsManager: serving default apex NS records for authoritative zone ${zoneName} (${nsDomains.join(', ')})`,
+      `DnsManager: serving default apex NS records for authoritative zone ${zoneName} `
+        + `(${nsDomains.join(', ')}); ownership verified via ${ownership.method} (${ownership.evidence})`,
     );
   }
 
+  // ==========================================================================
+  // Domain ownership
+  // ==========================================================================
+
+  /** Ownership inputs for every managed zone, fetched once per evaluation pass. */
+  public async listOwnershipZones(): Promise<IDomainOwnershipZone[]> {
+    const domains = await DomainDoc.findAll();
+    return domains.map((domainArg) => ({
+      name: domainArg.name,
+      source: domainArg.source,
+      providerId: domainArg.providerId,
+    }));
+  }
+
+  /**
+   * The authority set used as an ownership proof: the delegation-verified zones
+   * held in the database, and nothing else. Empty until the resolver is wired,
+   * which fails closed — an unwired manager proves ownership of nothing rather
+   * than falling back to a declared list that no longer exists.
+   */
+  public getAuthorityZones(): string[] {
+    return this.authorityZonesResolver?.() || [];
+  }
+
+  /**
+   * Supply the effective authority set. Injected rather than imported so
+   * DnsManager keeps a single direction of dependency and stays unit-testable.
+   */
+  public setAuthorityZonesResolver(resolver?: () => string[]): void {
+    this.authorityZonesResolver = resolver;
+  }
+
+  /**
+   * Re-derive every generated apex NS registration against the current authority
+   * set. Zones that gained proof start being served; zones that lost it are torn
+   * down — both in-process, with no restart.
+   *
+   * Throws on the first failure so the caller can roll the change back rather
+   * than leave the router half-converted.
+   */
+  public async reconcileAuthoritativeZones(): Promise<{ registered: string[]; unregistered: string[] }> {
+    const registered: string[] = [];
+    const unregistered: string[] = [];
+    if (!this.dnsServer) {
+      return { registered, unregistered };
+    }
+    const allDomains = await DomainDoc.findAll();
+    const ownershipZones: IDomainOwnershipZone[] = allDomains.map((domainArg) => ({
+      name: domainArg.name,
+      source: domainArg.source,
+      providerId: domainArg.providerId,
+    }));
+
+    for (const domain of allDomains) {
+      if (domain.source !== 'dcrouter') continue;
+      const zoneName = domain.name.toLowerCase();
+      const ownership = resolveDomainOwnership({
+        fqdn: zoneName,
+        zones: ownershipZones,
+        authorityZones: this.getAuthorityZones(),
+      });
+      const hasGenerated = this.runtimeRegistrations
+        .get(domain.id)?.get(this.rrsetKey(zoneName, 'NS'))?.origin === 'generated-default';
+
+      if (!ownership.verified && hasGenerated) {
+        // Authority lost: stop answering for it immediately.
+        this.untrackRuntimeRegistration(domain.id, zoneName, 'NS');
+        this.dnsServer.unregisterHandler(zoneName, ['NS']);
+        unregistered.push(zoneName);
+        continue;
+      }
+      if (ownership.verified && !hasGenerated) {
+        await this.registerAuthoritativeZoneDefaults(domain, ownershipZones);
+        if (this.runtimeRegistrations
+          .get(domain.id)?.get(this.rrsetKey(zoneName, 'NS'))?.origin === 'generated-default') {
+          registered.push(zoneName);
+        }
+      }
+    }
+
+    // Persisted records of newly-authoritative zones are already registered by
+    // applyDcrouterDomainsToDnsServer(); only the generated defaults are gated on
+    // ownership, so nothing else needs rebuilding here.
+    if (registered.length || unregistered.length) {
+      logger.log(
+        'info',
+        `DnsManager: authority reconciliation registered ${registered.length} and unregistered ${unregistered.length} generated apex NS zone(s)`,
+        { zone: 'dns' },
+      );
+    }
+    return { registered, unregistered };
+  }
+
+  /** Keep `DomainDoc.authoritative` honest after an authority change. */
+  public async syncAuthoritativeFlags(): Promise<number> {
+    const allDomains = await DomainDoc.findAll();
+    const ownershipZones: IDomainOwnershipZone[] = allDomains.map((domainArg) => ({
+      name: domainArg.name,
+      source: domainArg.source,
+      providerId: domainArg.providerId,
+    }));
+    const authorityZones = this.getAuthorityZones();
+    let changed = 0;
+    for (const domain of allDomains) {
+      if (domain.source !== 'dcrouter') continue;
+      const ownership = resolveDomainOwnership({
+        fqdn: domain.name,
+        zones: ownershipZones,
+        authorityZones,
+      });
+      if (domain.authoritative === ownership.verified) continue;
+      domain.authoritative = ownership.verified;
+      domain.updatedAt = Date.now();
+      await domain.save();
+      changed++;
+    }
+    return changed;
+  }
+
+  /**
+   * Can we prove the zone containing `fqdn` is ours? This gates certificate
+   * requirements and authoritative DNS. See ts/dns/domain-ownership.ts.
+   */
+  public async resolveDomainOwnership(fqdn: string): Promise<TDomainOwnership> {
+    return resolveDomainOwnership({
+      fqdn,
+      zones: await this.listOwnershipZones(),
+      authorityZones: this.getAuthorityZones(),
+    });
+  }
+
+  /**
+   * Ownership of a zone that is about to become dcrouter-hosted, evaluated
+   * against its post-write shape. Create and provider→dcrouter migration must
+   * not read their own pre-write row: the provider link they are removing would
+   * otherwise still count as the proof.
+   */
+  private async resolveOwnershipForPendingDcrouterZone(
+    zoneName: string,
+  ): Promise<TDomainOwnership> {
+    const name = zoneName.trim().toLowerCase();
+    const zones: IDomainOwnershipZone[] = (await this.listOwnershipZones())
+      .filter((zoneArg) => zoneArg.name.trim().toLowerCase() !== name);
+    zones.push({ name, source: 'dcrouter' });
+    return resolveDomainOwnership({
+      fqdn: name,
+      zones,
+      authorityZones: this.getAuthorityZones(),
+    });
+  }
+
   /**
    * Register a single record with the embedded DnsServer. The handler closure
    * captures the record fields, so updates require a re-register cycle.
@@ -167,13 +464,22 @@ export class DnsManager {
       }
       return null;
     });
+    // Tracked here rather than at each call site so the direct registration in
+    // migrateToDcrouter() is covered as well.
+    this.trackRuntimeRegistration(rec.domainId, rec.name, rec.type, 'persisted');
   }
 
   private rrsetKey(name: string, type: TDnsRecordType): string {
     return `${name.toLowerCase()}|${type}`;
   }
 
-  /** Rebuild one authoritative RRset atomically from persisted rows. */
+  /**
+   * Rebuild one authoritative RRset atomically from persisted rows.
+   *
+   * The unregister-then-rebuild cycle also replaces a generated default on the
+   * same key (an explicit apex NS row supersedes the generated one), so the
+   * registry is updated to match what is actually registered afterwards.
+   */
   private async refreshLocalRrset(
     domainId: string,
     name: string,
@@ -181,6 +487,7 @@ export class DnsManager {
   ): Promise<void> {
     if (!this.dnsServer) return;
     this.dnsServer.unregisterHandler(name, [type]);
+    this.untrackRuntimeRegistration(domainId, name, type);
     const records = await DnsRecordDoc.findByDomainId(domainId);
     for (const record of records) {
       if (record.name.toLowerCase() === name.toLowerCase() && record.type === type) {
@@ -511,8 +818,14 @@ export class DnsManager {
   }
 
   /**
-   * Create a dcrouter-hosted (authoritative) domain. dcrouter will serve
-   * DNS records for this domain via the embedded smartdns.DnsServer.
+   * Create a dcrouter-hosted domain. dcrouter serves DNS records for it via the
+   * embedded smartdns.DnsServer.
+   *
+   * `authoritative` reflects whether ownership can actually be proven — it used
+   * to be hard-coded to `true`, which let an ops-API caller self-assert authority
+   * over any zone on the internet. Creating the record still succeeds (it is the
+   * container records and provider migration need), but an unverified zone is
+   * recorded as non-authoritative and gets no generated apex NS handler.
    */
   public async createDcrouterDomain(args: {
     name: string;
@@ -527,17 +840,25 @@ export class DnsManager {
     if (existing) {
       throw new Error(`domain ${name} already exists`);
     }
+    const ownership = await this.resolveOwnershipForPendingDcrouterZone(name);
     const now = Date.now();
     const doc = new DomainDoc();
     doc.id = plugins.uuid.v4();
     doc.name = name;
     doc.source = 'dcrouter';
-    doc.authoritative = true;
+    doc.authoritative = ownership.verified;
     doc.description = args.description;
     doc.createdAt = now;
     doc.updatedAt = now;
     doc.createdBy = args.createdBy;
     await doc.save();
+    if (!ownership.verified) {
+      logger.log(
+        'error',
+        `DnsManager: created dcrouter-hosted domain ${name} as NON-authoritative — ${ownership.detail}`,
+        { zone: 'dns', domainId: doc.id, ownershipReason: ownership.reason },
+      );
+    }
     await this.registerAuthoritativeZoneDefaults(doc);
     return doc.id;
   }
@@ -621,26 +942,33 @@ export class DnsManager {
    * For dcrouter-hosted domains, also unregisters records from the embedded
    * DnsServer.
    *
-   * Note: smartdns has no public unregister-by-name API in the version pinned
-   * here, so local record deletes only take effect after a restart. The DB
-   * is the source of truth and the next start will not register the deleted
-   * record.
+   * The unregister path is complete in-process: every runtime handler this
+   * manager registered for the domain — persisted RRsets and generated defaults
+   * alike — is removed from the registry, so deletion never leaves stale
+   * authority answering `aa` until an unrelated restart. Nameserver glue
+   * handlers and other domains' handlers are never touched, because only the
+   * domain's own recorded registrations are removed.
    */
   public async deleteDomain(id: string): Promise<boolean> {
     const doc = await DomainDoc.findById(id);
     if (!doc) return false;
+    // Tear runtime state down before the durable rows go away: the registry is
+    // the authority on what to remove, so this does not depend on the records
+    // still being readable.
+    this.tearDownDomainRuntimeRegistrations(id);
     const records = await DnsRecordDoc.findByDomainId(id);
-    const localRrsets = new Set(records.map((record) => this.rrsetKey(record.name, record.type)));
     for (const r of records) {
       await r.delete();
     }
-    if (doc.source === 'dcrouter' && this.dnsServer) {
-      for (const rrset of localRrsets) {
-        const [name, type] = rrset.split('|') as [string, TDnsRecordType];
-        this.dnsServer.unregisterHandler(name, [type]);
-      }
-    }
     await doc.delete();
+    const leftover = this.listRuntimeRegistrations(id);
+    if (leftover.length > 0) {
+      logger.log(
+        'error',
+        `DnsManager: ${leftover.length} runtime DNS handler key(s) are still registered for deleted domain ${doc.name}`,
+        { zone: 'dns', domainId: id },
+      );
+    }
     return true;
   }
 
@@ -843,6 +1171,13 @@ export class DnsManager {
       }
     }
 
+    // The provider is authoritative from here on, so every runtime handler we
+    // still own for this zone goes away — including the generated apex NS and any
+    // record whose individual migration above threw. Leaving them registered
+    // would keep answering `aa` for a zone we no longer serve: the same
+    // stale-authority leak that deletion had.
+    this.tearDownDomainRuntimeRegistrations(domain.id);
+
     // Update domain metadata
     domain.source = 'provider';
     domain.authoritative = false;
@@ -879,15 +1214,25 @@ export class DnsManager {
       }
     }
 
-    // Update domain metadata
+    // Update domain metadata. Losing the provider link means the credentialed
+    // zone listing no longer proves ownership, so authority is re-derived rather
+    // than assumed.
     domain.source = 'dcrouter';
-    domain.authoritative = true;
     domain.providerId = undefined;
     domain.externalZoneId = undefined;
     domain.nameservers = undefined;
     domain.lastSyncedAt = undefined;
     domain.updatedAt = Date.now();
+    const ownership = await this.resolveOwnershipForPendingDcrouterZone(domain.name);
+    domain.authoritative = ownership.verified;
     await domain.save();
+    if (!ownership.verified) {
+      logger.log(
+        'error',
+        `DnsManager: domain ${domain.name} migrated to dcrouter as NON-authoritative — ${ownership.detail}`,
+        { zone: 'dns', domainId: domain.id, ownershipReason: ownership.reason },
+      );
+    }
     await this.registerAuthoritativeZoneDefaults(domain);
 
     logger.log('info', `Domain ${domain.name} migrated to dcrouter (${migrated} records)`);
@@ -1077,6 +1422,7 @@ export class DnsManager {
    * Unregister a record's handler from the embedded DnsServer.
    */
   public unregisterRecordFromDnsServer(rec: DnsRecordDoc): void {
+    this.untrackRuntimeRegistration(rec.domainId, rec.name, rec.type);
     if (!this.dnsServer) return;
     this.dnsServer.unregisterHandler(rec.name, [rec.type]);
   }

package/ts/errors/error.codes.ts

@@ -80,6 +80,10 @@ export const DCR_ROUTING_ERROR = 'DCR_ROUTING_ERROR';
 export const DCR_CONFIGURATION_ERROR = 'DCR_CONFIGURATION_ERROR';
 export const DCR_PROXY_ERROR = 'DCR_PROXY_ERROR';
 export const DCR_DOMAIN_ERROR = 'DCR_DOMAIN_ERROR';
+/** A certificate requirement or authoritative DNS zone was requested for a domain we cannot prove we own. */
+export const DCR_DOMAIN_OWNERSHIP_UNVERIFIED = 'DCR_DOMAIN_OWNERSHIP_UNVERIFIED';
+/** ACME failed for a configuration cause that no amount of retrying can resolve. */
+export const DCR_ACME_PERMANENT_FAILURE = 'DCR_ACME_PERMANENT_FAILURE';
 
 // SMS service errors (SMS_*)
 export const SMS_SERVICE_ERROR = 'SMS_SERVICE_ERROR';

package/ts/opsserver/classes.opsserver.ts

@@ -37,6 +37,7 @@ export class OpsServer {
   private usersHandler!: handlers.UsersHandler;
   private dnsProviderHandler!: handlers.DnsProviderHandler;
   private domainHandler!: handlers.DomainHandler;
+  private dnsAuthorityHandler!: handlers.DnsAuthorityHandler;
   private dnsRecordHandler!: handlers.DnsRecordHandler;
   private acmeConfigHandler!: handlers.AcmeConfigHandler;
   private emailDomainHandler!: handlers.EmailDomainHandler;
@@ -104,6 +105,7 @@ export class OpsServer {
     this.usersHandler = new handlers.UsersHandler(this);
     this.dnsProviderHandler = new handlers.DnsProviderHandler(this);
     this.domainHandler = new handlers.DomainHandler(this);
+    this.dnsAuthorityHandler = new handlers.DnsAuthorityHandler(this);
     this.dnsRecordHandler = new handlers.DnsRecordHandler(this);
     this.acmeConfigHandler = new handlers.AcmeConfigHandler(this);
     this.emailDomainHandler = new handlers.EmailDomainHandler(this);

package/ts/opsserver/handlers/acme-config.handler.ts

@@ -66,6 +66,13 @@ export class AcmeConfigHandler {
               },
               userId,
             );
+            // The SmartAcme startup budget does not re-arm on a timer, so a
+            // corrected ACME configuration must re-arm it explicitly. Otherwise a
+            // permanently-failed or exhausted provider stays down until an
+            // unrelated SmartProxy rebuild or a restart (30–60 s of outage).
+            this.opsServerRef.dcRouterRef.smartAcmeLifecycle?.rearm(
+              'ACME configuration updated',
+            );
             return { success: true, config: updated };
           } catch (err: unknown) {
             return { success: false, message: (err as Error).message };