gowalk-cicd 1.0.79 → 1.0.81

package/CLAUDE.md

@@ -177,7 +177,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   explicit workflow dispatch remains available. Keep backend deployment's own path filters
   intact, and do not broadly exclude assets, root build settings or unknown app layouts.
 - Domain-backed backend deploys fail closed on certificate issuance and the
-  public HTTPS health probe. `select_certbot_account.sh` chooses one existing
+  public HTTPS health probe. The probe requires a completed 2xx response with normal TLS
+  verification; a redirect, including one to the same URL, is not healthy. Each attempt
+  has bounded connection/total time and retains only curl exit and HTTP status diagnostics.
+  `select_certbot_account.sh` chooses one existing
   Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
   non-interactive; legacy v1 account directories are not valid candidates.
   `ensure_certificate.sh` preserves failed inventory status and retries only Certbot's
@@ -186,6 +189,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   no-certificate sentinel. Empty/malformed output and arbitrary errors never mean absence. Raw command
   output stays in an owned private temporary directory removed on exit. Do not remove
   Certbot locks, stop other processes, force renewal or bypass the public HTTPS health gate.
+  Docker port changes update only the managed nginx upstream, preserving existing TLS directives.
+  Existing certificate inventory is followed by domain-scoped `certbot install`, so a legacy
+  HTTP-only vhost also recovers without reissuance. Installation shares the bounded lock-only retry.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/README.md

@@ -97,6 +97,8 @@ it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
 wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
 Hosts with several existing Let's Encrypt accounts select one deterministically,
 and a domain deploy fails unless its public HTTPS certificate and health route validate.
+Changing a container's published port preserves its existing HTTPS configuration. An existing
+certificate is installed for the requested domain on redeploy, repairing older HTTP-only vhosts too.
 
 Requirements on the consumer repo:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.79
+1.0.81

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.79
+1.0.81

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.79
+1.0.81

package/backend-action/action.yml

@@ -128,6 +128,7 @@ runs:
           "${{ github.action_path }}/remote_deploy.sh" \
           "${{ github.action_path }}/select_certbot_account.sh" \
           "${{ github.action_path }}/ensure_certificate.sh" \
+          "${{ github.action_path }}/configure_vhost.py" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host

package/backend-action/configure_vhost.py

@@ -0,0 +1,64 @@
+"""Update one managed nginx upstream without discarding Certbot's HTTPS configuration."""
+import os
+from pathlib import Path
+import re
+import stat
+import sys
+import tempfile
+
+
+def content(previous, domain, port):
+    if not re.fullmatch(r"[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?", domain) or not 0 < port < 65536:
+        raise ValueError("invalid domain or port")
+    if previous:
+        names = re.findall(r"(?m)^\s*server_name\s+([^;]+);", previous)
+        if not names or any(name.strip() != domain for name in names):
+            raise ValueError("vhost belongs to another domain")
+        pattern = r"(?m)^(\s*proxy_pass\s+http://127\.0\.0\.1:)\d+(;[^\n]*$)"
+        result, count = re.subn(pattern, lambda match: f"{match[1]}{port}{match[2]}", previous)
+        if count != 1:
+            raise ValueError("managed upstream is not unique")
+        return result
+    return f"""server {{
+    listen 80;
+    server_name {domain};
+    client_max_body_size 100m;
+    location / {{
+        proxy_pass http://127.0.0.1:{port};
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }}
+}}
+"""
+
+
+def configure(path, domain, port):
+    if path.is_symlink():
+        raise ValueError("managed vhost must not be a symlink")
+    previous = path.read_text() if path.exists() else ""
+    updated = content(previous, domain, port)
+    if previous == updated:
+        return "unchanged"
+    mode = stat.S_IMODE(path.stat().st_mode) if path.exists() else 0o644
+    fd, temporary = tempfile.mkstemp(prefix=path.name + ".", dir=path.parent)
+    try:
+        with os.fdopen(fd, "w") as output:
+            os.fchmod(output.fileno(), mode)
+            output.write(updated)
+            output.flush()
+            os.fsync(output.fileno())
+        os.replace(temporary, path)
+    finally:
+        Path(temporary).unlink(missing_ok=True)
+    return "changed"
+
+
+if __name__ == "__main__":
+    try:
+        print(configure(Path(sys.argv[1]), sys.argv[2], int(sys.argv[3])))
+    except (OSError, ValueError):
+        sys.exit("Cannot update the managed nginx vhost; its domain and upstream must be unambiguous")

package/backend-action/ensure_certificate.sh

@@ -25,7 +25,7 @@ certbot_attempt() {
 
 certificate_present() {
   # 0=present, 1=confirmed absent, 2=unrecognized/partial inventory; preserve other awk failures.
-  awk -v domain="$1" '
+  awk -v domain="$1" -v emit_name="${2:-}" '
     function valid_san(value, labels, count, i, compressed, groups) {
       if (index(value, ":")) {
         count = split(value, labels, "::"); if (count > 2) return 0
@@ -49,12 +49,20 @@ certificate_present() {
     /^Found the following certs:$/ { if (mode) bad = 1; mode = 1; next }
     $1 == "Certificate" && $2 == "Name:" {
       if (mode != 1 || NF < 3 || (records && sans != 1)) bad = 1
+      name = $0; sub(/^[[:space:]]*Certificate Name:[[:space:]]*/, "", name)
+      if (index(name, "/") || index(name, "\\") || name == "." || name == "..") bad = 1
       records++; sans = 0; next
     }
     $1 == "Domains:" || $1 == "Identifiers:" {
       if (mode != 1 || !records || sans || NF < 2) bad = 1
       sans++
-      for (i = 2; i <= NF; i++) { if (!valid_san($i)) bad = 1; if ($i == domain) found = 1 }
+      for (i = 2; i <= NF; i++) {
+        if (!valid_san($i)) bad = 1
+        if ($i == domain) {
+          if (!found || name == domain || (selected != domain && name < selected)) selected = name
+          found = 1
+        }
+      }
       next
     }
     /^[[:space:]]+(Serial Number|Key Type|Expiry Date|Certificate Path|Private Key Path):/ {
@@ -64,6 +72,7 @@ certificate_present() {
     { bad = 1 }
     END {
       if (bad || !mode || (mode == 1 && (!records || sans != 1))) exit 2
+      if (found && emit_name) print selected
       exit !found
     }
   ' "$CERTBOT_WORK/stdout"
@@ -81,7 +90,7 @@ request_certificate() {
 }
 
 ensure_certificate() (
-  local domain="$1" email="$2" delay attempt=0 status=1 CERTBOT_WORK
+  local domain="$1" email="$2" delay name attempt=0 status=1 CERTBOT_WORK
   CERTBOT_WORK="$(mktemp -d "${TMPDIR:-/tmp}/gowalk-certbot.XXXXXXXX")" || return $?
   trap 'rm -rf -- "$CERTBOT_WORK"' EXIT
   trap 'exit 130' INT
@@ -94,9 +103,17 @@ ensure_certificate() (
       sleep "$delay" || return $?
     fi
     if certbot_attempt inventory "$attempt" certificates; then
-      if certificate_present "$domain"; then
+      if name="$(certificate_present "$domain" name)"; then
         log "cert for $domain already present"
-        return 0
+        # Inventory proves possession, not nginx installation. Repair an HTTP-only legacy vhost too.
+        if certbot_attempt installation "$attempt" install --nginx --cert-name "$name" \
+            -d "$domain" --non-interactive --redirect; then
+          return 0
+        else
+          status=$?
+          certbot_lock_busy && continue
+          return "$status"
+        fi
       else
         status=$?
         if [ "$status" -ne 1 ]; then

package/backend-action/remote_deploy.sh

@@ -73,24 +73,9 @@ fi
 
 # ── nginx vhost → proxy the domain to the published port
 VHOST="/etc/nginx/conf.d/backend-$APP.conf"
-if [ ! -f "$VHOST" ] || ! grep -q "127.0.0.1:$PORT" "$VHOST"; then
-  log "writing nginx vhost $VHOST → 127.0.0.1:$PORT"
-  cat > "$VHOST" <<NGINX
-server {
-    listen 80;
-    server_name $DOMAIN;
-    client_max_body_size 100m;
-    location / {
-        proxy_pass http://127.0.0.1:$PORT;
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_read_timeout 120s;
-    }
-}
-NGINX
+VHOST_STATE="$(python3 "$DIR/configure_vhost.py" "$VHOST" "$DOMAIN" "$PORT")"
+if [ "$VHOST_STATE" = changed ]; then
+  log "updated nginx upstream for $DOMAIN → 127.0.0.1:$PORT"
   nginx -t && systemctl reload nginx
 fi
 
@@ -107,11 +92,15 @@ fi
 # and the application together; a green deploy must mean the public API works.
 PUBLIC_HEALTHY=""
 for i in $(seq 1 15); do
-  if curl -fsS "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
+  CURL_EXIT=0
+  HTTP_CODE="$(curl --disable --silent --output /dev/null --write-out '%{http_code}' \
+    --proto '=https' --connect-timeout 5 --max-time 10 "https://$DOMAIN$HEALTH")" || CURL_EXIT=$?
+  if [ "$CURL_EXIT" -eq 0 ] && [[ "$HTTP_CODE" =~ ^2[0-9]{2}$ ]]; then
     log "public https://$DOMAIN$HEALTH healthy (after ${i}x2s)"
     PUBLIC_HEALTHY=1
     break
   fi
+  log "public health not ready (curl=$CURL_EXIT, http=$HTTP_CODE, attempt=$i/15)"
   sleep 2
 done
 if [ -z "$PUBLIC_HEALTHY" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.79",
+  "version": "1.0.81",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {