openship 0.4.8 → 0.6.0

package/dist/{chunk-FXTBHTWY.js → chunk-QEH4QUBX.js}

@@ -1,24 +1,40 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  sq
-} from "./chunk-FPRHYBY2.js";
+  edgeDownExplanation,
+  explainEdgeDown,
+  isEdgeDownFailure
+} from "./chunk-I3DPMTSF.js";
+import {
+  edgeFailureReason
+} from "./chunk-VZ2ZHPS2.js";
 import {
   ACME_CHALLENGE_LOCATION,
   ACME_HTTP01_PORT,
+  EDGE_CHALLENGE_DIR,
+  EDGE_CHALLENGE_LOCATION,
+  EDGE_CHALLENGE_URL_PREFIX,
   LUA_LOGGER_PATH,
   RULES_GUARD_PATH,
   buildReloadCommand,
   detectOpenRestyPaths,
+  edgeChallengeVhostConf,
   luaSourceAvailable
-} from "./chunk-VFINNTUL.js";
+} from "./chunk-OGY63DGD.js";
+import {
+  logEntry,
+  sq
+} from "./chunk-ZFJXPCQP.js";
 import {
-  PROXY_GZIP_TYPES,
+  PROXY_DIRECTIVES,
+  parseProxyValue,
+  resolveProxyDirectives,
+  resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-6APULWSU.js";
+} from "./chunk-OTLSJYAC.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -31,9 +47,9 @@ import {
   stat as fsStat
 } from "fs/promises";
 import { execFile as cpExecFile } from "child_process";
-import { randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import { promisify } from "util";
-import { dirname, join } from "path";
+import { posix as edgePath } from "path";
 
 // ../../packages/adapters/src/system/proxy/cert-material.ts
 import { X509Certificate, createPrivateKey } from "crypto";
@@ -42,6 +58,15 @@ import { X509Certificate, createPrivateKey } from "crypto";
 function containerCommand(container, command) {
   return `docker exec ${sq(container)} sh -c ${sq(command)}`;
 }
+async function diagnoseEdgeDown(inner, container) {
+  const status = await inner.exec(`docker inspect -f '{{.State.Status}}' ${sq(container)} 2>/dev/null`).catch(() => null);
+  const logs = await inner.exec(`docker logs --tail 40 ${sq(container)} 2>&1`).catch(() => null);
+  return explainEdgeDown({
+    container,
+    status: status?.trim() || null,
+    reason: logs ? edgeFailureReason(logs) : null
+  });
+}
 function resolveRef(ref) {
   return typeof ref === "function" ? ref() : ref;
 }
@@ -68,8 +93,34 @@ async function writeEdgeFileIn(inner, container, path, content) {
 function edgeContainerExecutor(inner, container, opts) {
   const inContainer = (command) => containerCommand(container, command);
   const overrides = {
-    exec: (command, execOpts) => inner.exec(inContainer(command), execOpts),
-    streamExec: (command, onLog) => inner.streamExec(inContainer(command), onLog),
+    // Both command paths enrich a "the container isn't up" failure with the
+    // container's name, state and `[emerg]` — see `diagnoseEdgeDown`. Gated on the
+    // narrow daemon/nginx signatures (`isEdgeDownFailure`), because a non-zero exit
+    // is ordinary here: the container-file probes report a missing path that way, and
+    // paying two `docker` round-trips per miss would be a real cost on every read.
+    exec: async (command, execOpts) => {
+      try {
+        return await inner.exec(inContainer(command), execOpts);
+      } catch (err) {
+        const message = err?.message ?? String(err);
+        if (!isEdgeDownFailure(message)) throw err;
+        throw new Error(`${await diagnoseEdgeDown(inner, container)}
+${message}`);
+      }
+    },
+    // streamExec REPORTS failure instead of throwing it, and its callers build the
+    // error they raise out of what was streamed (`_execCertbot` accumulates the log
+    // lines and throws that text). So the explanation has to go through `onLog` to
+    // reach them — appending it only to the return value would leave certbot's
+    // caller raising the daemon's bare container id, which is the original bug.
+    streamExec: async (command, onLog, opts2) => {
+      const result = await inner.streamExec(inContainer(command), onLog, opts2);
+      if (result.code === 0 || !isEdgeDownFailure(result.output)) return result;
+      const explanation = await diagnoseEdgeDown(inner, container);
+      onLog(logEntry(explanation, "error"));
+      return { code: result.code, output: `${explanation}
+${result.output}` };
+    },
     // A rename is a FILE op, so it follows the files, never the commands. Stated
     // here rather than left to the Proxy's passthrough: if the inner executor has no
     // `rename`, the fallback must still be the INNER shell (the host) — routing it
@@ -218,8 +269,13 @@ function validateCertFor(host, pems, source) {
 function isSafeCertPath(p) {
   return /^\/[A-Za-z0-9._/-]+$/.test(p) && !p.includes("..");
 }
+var BOOTSTRAP_CERT_SEGMENT = "openship-bootstrap";
+function isBootstrapCertPath(p) {
+  return p.split("/").includes(BOOTSTRAP_CERT_SEGMENT);
+}
 async function readDeclaredPair(exec, certPath, keyPath, container) {
   if (!isSafeCertPath(certPath) || !isSafeCertPath(keyPath)) return null;
+  if (isBootstrapCertPath(certPath) || isBootstrapCertPath(keyPath)) return null;
   const certPem = await readMaybeInContainer(exec, certPath, container);
   const keyPem = await readMaybeInContainer(exec, keyPath, container);
   return certPem && keyPem ? { certPem, keyPem } : null;
@@ -248,13 +304,20 @@ async function probeStaticOutput(executor, servedPath) {
 }
 
 // ../../packages/adapters/src/infra/nginx.ts
+var { dirname, join } = edgePath;
 var PROXY_HEADERS = `proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $openship_fwd_proto;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";`;
+var FORWARD_VARS = `    set $openship_fwd_proto $scheme;
+    set $openship_redirect_https 1;
+    if ($http_x_forwarded_proto = "https") {
+        set $openship_fwd_proto https;
+        set $openship_redirect_https 0;
+    }`;
 function renderProxyLocations(route) {
   if (!route.proxyLocations || route.proxyLocations.length === 0) return "";
   return route.proxyLocations.map((loc) => {
@@ -266,6 +329,12 @@ function renderProxyLocations(route) {
     }`;
   }).join("");
 }
+function renderHostRedirect(route) {
+  const redirect = route.redirectHost;
+  if (!redirect?.target) return null;
+  assertValidDomain(redirect.target);
+  return `return ${resolveRedirectStatus(redirect.statusCode)} https://${redirect.target}$request_uri;`;
+}
 function renderRedirects(route) {
   if (!route.redirects || route.redirects.length === 0) return "";
   return route.redirects.map(
@@ -283,27 +352,20 @@ function renderServerHeaders(route) {
   return lines.length > 0 ? `
 ${lines.join("\n")}` : "";
 }
-function renderProxyOptions(proxy) {
-  const p = sanitizeProxySettings(proxy);
-  if (!p) return "";
-  const lines = [];
-  if (p.clientMaxBodySize) lines.push(`    client_max_body_size ${p.clientMaxBodySize};`);
-  if (p.proxyReadTimeout) lines.push(`    proxy_read_timeout ${p.proxyReadTimeout};`);
-  if (p.proxySendTimeout) lines.push(`    proxy_send_timeout ${p.proxySendTimeout};`);
-  if (p.clientBodyTimeout) lines.push(`    client_body_timeout ${p.clientBodyTimeout};`);
-  if (p.proxyBuffering !== void 0) {
-    lines.push(`    proxy_buffering ${p.proxyBuffering ? "on" : "off"};`);
-  }
-  if (p.gzip !== void 0) {
-    lines.push(`    gzip ${p.gzip ? "on" : "off"};`);
-    if (p.gzip) {
-      lines.push(`    gzip_types ${PROXY_GZIP_TYPES};`);
-      lines.push(`    gzip_min_length 1024;`);
-    }
-  }
+function renderProxyDirectives(proxy, opts) {
+  const lines = resolveProxyDirectives(proxy, {
+    scope: opts.tlsOnly ? "tls" : "shared",
+    ...opts.nginxVersion !== void 0 ? { nginxVersion: opts.nginxVersion } : {}
+  }).map((d) => `    ${d.directive} ${d.text};`);
   return lines.length > 0 ? `
 ${lines.join("\n")}` : "";
 }
+function renderProxyOptions(proxy, nginxVersion) {
+  return renderProxyDirectives(proxy, { tlsOnly: false, nginxVersion });
+}
+function renderProxyTlsOptions(proxy, nginxVersion) {
+  return renderProxyDirectives(proxy, { tlsOnly: true, nginxVersion });
+}
 function renderGeoEntries(whitelist) {
   const entries = [
     "        default         0;",
@@ -318,6 +380,46 @@ function renderGeoEntries(whitelist) {
   return entries;
 }
 var DEFAULT_CERT_DIR = "/etc/letsencrypt/live";
+var LETSENCRYPT_PRODUCTION_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";
+function assertValidAcmeOptions(opts) {
+  if (!!opts.acmeEabKid !== !!opts.acmeEabHmacKey) {
+    throw new Error("ACME EAB requires both a key identifier and an HMAC key");
+  }
+  if (opts.acmeDirectoryUrl) {
+    let directory;
+    try {
+      directory = new URL(opts.acmeDirectoryUrl);
+    } catch {
+      throw new Error("ACME directory must be a valid http(s) URL");
+    }
+    if (directory.protocol !== "https:" && directory.protocol !== "http:") {
+      throw new Error("ACME directory must use http or https");
+    }
+  }
+  if (opts.acmeEabKid && (!/^[\x20-\x7E]+$/.test(opts.acmeEabKid) || opts.acmeEabKid.length > 512)) {
+    throw new Error("ACME EAB key identifier must be printable ASCII (maximum 512 characters)");
+  }
+  if (opts.acmeEabHmacKey && !/^[A-Za-z0-9_-]+={0,2}$/.test(opts.acmeEabHmacKey)) {
+    throw new Error("ACME EAB HMAC key must be base64url encoded");
+  }
+  if (opts.acmeCaBundle && !opts.acmeCaBundle.startsWith("/")) {
+    throw new Error("ACME CA bundle must be an absolute path in the Certbot environment");
+  }
+}
+function acmeKeyArgs(keyType) {
+  switch (keyType) {
+    case "ec256":
+      return ["--key-type", "ecdsa", "--elliptic-curve", "secp256r1"];
+    case "ec384":
+      return ["--key-type", "ecdsa", "--elliptic-curve", "secp384r1"];
+    case "rsa2048":
+      return ["--key-type", "rsa", "--rsa-key-size", "2048"];
+    case "rsa4096":
+      return ["--key-type", "rsa", "--rsa-key-size", "4096"];
+    default:
+      return [];
+  }
+}
 var DOMAIN_RE = /^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
 function assertValidDomain(domain) {
   if (!DOMAIN_RE.test(domain) || domain.length > 253) {
@@ -335,6 +437,12 @@ function assertValidUpstream(targetUrl) {
     throw new Error(`Invalid proxy target (must be http/https URL): ${targetUrl}`);
   }
 }
+var CHALLENGE_TOKEN_RE = /^[A-Za-z0-9][A-Za-z0-9._~-]{7,127}$/;
+function assertValidChallengeToken(token) {
+  if (!CHALLENGE_TOKEN_RE.test(token) || token.includes("..")) {
+    throw new Error(`Invalid edge-target challenge token: ${token}`);
+  }
+}
 var MANAGED_STATIC_BASE = "/opt/openship";
 function assertValidStaticRoot(root, opts) {
   assertNoNginxInjection(root, "static root");
@@ -351,46 +459,83 @@ function assertValidStaticRoot(root, opts) {
 }
 var execFileAsync = promisify(cpExecFile);
 function summarizeCertbotFailure(output, domain) {
+  const edgeDown = edgeDownExplanation(output);
+  if (edgeDown) return edgeDown;
+  const structured = certbotDiagnosis(output, domain);
+  if (structured) return structured;
+  const lines = (output || "").split("\n").map((l) => l.trim()).filter(Boolean);
+  return lines.slice(-3).join(" \xB7 ") || `certbot failed to issue a certificate for ${domain}`;
+}
+function certbotDiagnosis(output, domain) {
   const text = output || "";
   const pick = (re) => text.match(re)?.[0]?.replace(/\s+/g, " ").trim();
   const detail = pick(/Detail:\s*[^\n]+/i);
   const hint = pick(/Hint:\s*[^\n]+/i);
+  const challengeUrl = pick(/https?:\/\/\S*\.well-known\/acme-challenge\/\S*/i);
+  const redirectedToHttps = /^https:/i.test(challengeUrl ?? "");
   let diagnosis;
   if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
   } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
+  } else if (/\b52[56]\b|ssl handshake failed/i.test(text)) {
+    diagnosis = `Cloudflare's proxy is answering the certificate challenge for ${domain} instead of forwarding it to this server: it redirects the request to HTTPS, then rejects the origin's TLS. Fix it one of three ways \u2014 set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record until it is, or upload a Cloudflare Origin CA certificate from the Domains tab and skip Let's Encrypt entirely.`;
   } else if (/404|invalid response|unauthorized|"?status"?:?\s*40\d/i.test(text)) {
-    diagnosis = `Port 80 answered but not with our ACME challenge \u2014 another web server is still serving :80, so the takeover didn't complete. Re-run and choose take-over / migrate.`;
+    diagnosis = redirectedToHttps ? `The challenge for ${domain} was redirected from HTTP to HTTPS and then answered with a 404 \u2014 so whatever served it isn't routing that hostname. If ${domain} is behind Cloudflare, its "Always Use HTTPS" is doing the redirect: set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record. Otherwise check the A record points at this server and the domain is registered here. Nothing is occupying :80, so take-over / migrate will not help.` : `Port 80 answered but not with our ACME challenge \u2014 another web server is still serving :80, so the takeover didn't complete. Re-run and choose take-over / migrate.`;
   } else if (/too many certificates|rateLimited|rate limit/i.test(text)) {
     diagnosis = `Let's Encrypt rate limit reached for ${domain} \u2014 wait before retrying.`;
   }
   const parts = [diagnosis, detail, hint].filter(Boolean);
-  if (parts.length > 0) return parts.join(" \u2014 ");
-  const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
-  return lines.slice(-3).join(" \xB7 ") || `certbot failed to issue a certificate for ${domain}`;
+  return parts.length > 0 ? parts.join(" \u2014 ") : void 0;
 }
 var NginxProvider = class {
   sitesDir;
   acmeEmail;
+  acmeDirectoryUrl;
+  acmeEabKid;
+  acmeEabHmacKey;
+  acmeKeyType;
+  acmeCaBundle;
+  acmeTosAgreed;
   certDir;
   executor;
   reloadCommand;
   pinPaths;
+  containerEdge;
+  challengeDir;
+  /**
+   * nginx version of the edge, when `detectOpenRestyPaths` could read it. Gates the
+   * one directive whose syntax is version-dependent (`http2`); undefined = unknown,
+   * which `proxyDirectiveAllowed` treats as allow.
+   */
+  nginxVersion;
   constructor(opts) {
+    assertValidAcmeOptions(opts);
     this.sitesDir = opts.paths.sitesDir;
+    this.nginxVersion = opts.paths.nginxVersion;
     this.acmeEmail = opts.acmeEmail;
+    this.acmeDirectoryUrl = opts.acmeDirectoryUrl;
+    this.acmeEabKid = opts.acmeEabKid;
+    this.acmeEabHmacKey = opts.acmeEabHmacKey;
+    this.acmeKeyType = opts.acmeKeyType;
+    this.acmeCaBundle = opts.acmeCaBundle;
+    this.acmeTosAgreed = opts.acmeTosAgreed ?? true;
     this.certDir = opts.certDir ?? DEFAULT_CERT_DIR;
     this.executor = opts.executor ?? null;
-    this.reloadCommand = buildReloadCommand(opts.paths);
+    this.containerEdge = opts.containerEdge ?? false;
+    this.reloadCommand = buildReloadCommand(opts.paths, { containerEdge: this.containerEdge });
     this.pinPaths = opts.pinPaths ?? false;
+    this.challengeDir = opts.challengeDir ?? EDGE_CHALLENGE_DIR;
   }
   // ── File operation helpers (dual-path: local or remote) ──────────────
-  async _writeFile(path, content) {
+  async _writeFile(path, content, mode) {
     const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}`;
     if (this.executor) {
       try {
         await this.executor.writeFile(tmpPath, content);
+        if (mode !== void 0) {
+          await this.executor.exec(`chmod ${sq(mode.toString(8))} ${sq(tmpPath)}`);
+        }
         if (this.executor.rename) {
           await this.executor.rename(tmpPath, path);
         } else {
@@ -403,7 +548,7 @@ var NginxProvider = class {
     } else {
       await fsMkdir(dirname(path), { recursive: true });
       try {
-        await fsWriteFile(tmpPath, content, "utf-8");
+        await fsWriteFile(tmpPath, content, { encoding: "utf-8", mode });
         await fsRename(tmpPath, path);
       } catch (err) {
         await fsRm(tmpPath).catch(() => void 0);
@@ -433,7 +578,7 @@ var NginxProvider = class {
       await this.executor.rm(path);
     } else {
       try {
-        await fsRm(path);
+        await fsRm(path, { recursive: true, force: true });
       } catch {
       }
     }
@@ -476,6 +621,97 @@ var NginxProvider = class {
       await this._rm(staging).catch(() => void 0);
     }
   }
+  /**
+   * Where a domain's temporary self-signed cert lives — a SIBLING of certbot's
+   * `live/`, deliberately not inside it. See {@link ensureBootstrapCert}.
+   */
+  bootstrapCertDir(domain) {
+    return join(dirname(this.certDir), BOOTSTRAP_CERT_SEGMENT, domain);
+  }
+  /**
+   * Ensure a self-signed placeholder cert exists for `domain`, so a route whose TLS
+   * we terminate can ALWAYS complete a TLS handshake — including before certbot has
+   * issued anything.
+   *
+   * Why a missing :443 block is a hard failure, not a soft one: an unmatched SNI
+   * falls through to the edge's :443 catch-all, which answers with the "service not
+   * found" page (#431) under a placeholder certificate that belongs to no domain.
+   * For a domain we DO route that is a broken site: the visitor is told nothing is
+   * deployed here, and behind Cloudflare "Full" — which accepts any origin cert —
+   * they get that page rather than the app. Issuance deadlocks with it: Cloudflare
+   * answers the HTTP-01 challenge with a 301 to https, the catch-all deliberately
+   * carries no ACME location on :443, so the challenge 404s and the vhost stays
+   * HTTP-only — forever (#308). A per-domain placeholder breaks the loop: the
+   * domain gets its OWN name-bound :443 block, the challenge completes, and the
+   * real cert takes over.
+   *
+   * So the :443 catch-all having gained a certificate of its own does NOT make this
+   * redundant — it only changed the symptom from a raw TLS error (#431's old error
+   * 525) into a wrong page. The catch-all's cert is deliberately valid for nothing;
+   * serving it for a domain we route is the cross-serving that block exists to
+   * prevent.
+   *
+   * Deliberately NOT written under `certDir`: `certsExist()` / `readCertInfo()`
+   * read that path, so a self-signed cert there would short-circuit provisionCert
+   * and report an untrusted cert as `active`, with the renewal scheduler and the
+   * verify-pending sweep both satisfied. Keeping it in a sibling dir means cert
+   * STATUS is untouched — the domain still reads provisioning/error and keeps
+   * retrying until a real cert lands.
+   *
+   * Returns null when nothing could be produced (no `openssl` on the executor, exec
+   * failure); the caller falls back to an HTTP-only vhost, exactly as before.
+   * Never throws — a placeholder must not be able to fail a deploy.
+   */
+  async ensureBootstrapCert(domain) {
+    const dir = this.bootstrapCertDir(domain);
+    const certPath = join(dir, "fullchain.pem");
+    const keyPath = join(dir, "privkey.pem");
+    try {
+      if (await this._exists(certPath) && await this._exists(keyPath)) {
+        return { certPath, keyPath };
+      }
+    } catch {
+      return null;
+    }
+    const staging = `${dir}.staging-${process.pid}-${randomBytes(4).toString("hex")}`;
+    try {
+      await this._mkdir(staging);
+      await this._exec("openssl", [
+        "req",
+        "-x509",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-keyout",
+        join(staging, "privkey.pem"),
+        "-out",
+        join(staging, "fullchain.pem"),
+        "-days",
+        "3650",
+        "-subj",
+        `/CN=${domain}`,
+        "-addext",
+        `subjectAltName=DNS:${domain}`
+      ]);
+      await this._mkdir(dir);
+      if (this.executor) {
+        await this.executor.exec(
+          `mv -f ${sq(join(staging, "fullchain.pem"))} ${sq(join(staging, "privkey.pem"))} ${sq(dir)}/`
+        );
+      } else {
+        await fsRename(join(staging, "fullchain.pem"), certPath);
+        await fsRename(join(staging, "privkey.pem"), keyPath);
+      }
+      return { certPath, keyPath };
+    } catch (err) {
+      console.warn(
+        `[SSL] could not create a temporary certificate for ${domain} \u2014 serving HTTP only until a real certificate is issued (is openssl installed on the edge?): ${safeErrorMessage(err)}`
+      );
+      return null;
+    } finally {
+      await this._rm(staging).catch(() => void 0);
+    }
+  }
   async _exec(command, args = []) {
     if (this.executor) {
       const full = args.length ? `${command} ${args.map(sq).join(" ")}` : command;
@@ -520,19 +756,65 @@ var NginxProvider = class {
    * still sees the real cause.
    */
   async _execCertbot(args, onLog) {
+    const command = this.acmeCaBundle ? "env" : "certbot";
+    const commandArgs = this.acmeCaBundle ? [`REQUESTS_CA_BUNDLE=${this.acmeCaBundle}`, "certbot", ...args] : args;
     if (!onLog || !this.executor) {
-      const out = await this._exec("certbot", args);
-      if (out) onLog?.(out);
-      return out;
+      let out;
+      try {
+        out = await this._exec(command, commandArgs);
+      } catch (err) {
+        throw new Error(this.redactAcmeSecrets(safeErrorMessage(err)));
+      }
+      const redacted = this.redactAcmeSecrets(out);
+      if (redacted) onLog?.(redacted);
+      return redacted;
     }
-    const full = `certbot ${args.map(sq).join(" ")}`;
+    const full = `${command} ${commandArgs.map(sq).join(" ")}`;
     let output = "";
     const { code } = await this.executor.streamExec(full, (log) => {
       output += log.message;
-      onLog(log.message);
+      onLog(this.redactAcmeSecrets(log.message));
     });
-    if (code !== 0) throw new Error(output.trim() || `certbot exited ${code}`);
-    return output;
+    if (code !== 0) {
+      throw new Error(this.redactAcmeSecrets(output).trim() || `certbot exited ${code}`);
+    }
+    return this.redactAcmeSecrets(output);
+  }
+  redactAcmeSecrets(value) {
+    return this.acmeEabHmacKey ? value.split(this.acmeEabHmacKey).join("[REDACTED]") : value;
+  }
+  /**
+   * Keep EAB HMAC material out of argv/process listings and remove it after use.
+   *
+   * Same layout contract as runtime/git-ssh-material.ts (the repo's other
+   * ephemeral-secret-on-disk site): the material lives in its OWN 0700 directory
+   * with the file at 0600, the bytes never travel through a shell command line,
+   * and cleanup removes the directory as a unit. The 0700 parent goes first, so
+   * even the temp file _writeFile stages is born unreadable to other users.
+   */
+  async createEphemeralEabConfig() {
+    if (!this.acmeEabKid || !this.acmeEabHmacKey) return null;
+    const dir = join(dirname(this.certDir), `.openship-eab-${randomBytes(12).toString("hex")}`);
+    const path = join(dir, "eab.ini");
+    if (this.executor) {
+      await this.executor.mkdir(dir);
+      await this._exec("chmod", ["700", dir]);
+    } else {
+      await fsMkdir(dir, { recursive: true, mode: 448 });
+    }
+    try {
+      await this._writeFile(
+        path,
+        `eab-kid = ${this.acmeEabKid}
+eab-hmac-key = ${this.acmeEabHmacKey}
+`,
+        384
+      );
+    } catch (err) {
+      await this._rm(dir).catch(() => void 0);
+      throw err;
+    }
+    return path;
   }
   async _captureFile(path) {
     if (!await this._exists(path)) {
@@ -562,34 +844,64 @@ var NginxProvider = class {
   async registerRoute(route) {
     assertValidDomain(route.domain);
     await this._mkdir(this.sitesDir);
-    const slug = this.domainSlug(route.domain);
+    const slug = await this.resolveSlug(route.domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     if ("staticRoot" in route && route.staticRoot) {
       assertValidStaticRoot(route.staticRoot, { adopted: route.staticRootAdopted });
     } else {
       assertValidUpstream(route.targetUrl);
     }
-    const locationBody = "staticRoot" in route && route.staticRoot ? `root ${route.staticRoot};
+    const hostRedirect = renderHostRedirect(route);
+    const locationBody = hostRedirect ? hostRedirect : "staticRoot" in route && route.staticRoot ? `root ${route.staticRoot};
         index index.html;
         try_files $uri $uri/ /index.html;` : `proxy_pass ${route.targetUrl};
         ${PROXY_HEADERS}`;
-    const extraLocations = `${renderRedirects(route)}${renderProxyLocations(route)}`;
-    const serverHeaders = renderServerHeaders(route);
-    const proxyOpts = renderProxyOptions(route.proxy);
-    const webhookLocation = route.webhookProxy ? `
+    const extraLocations = hostRedirect ? "" : `${renderRedirects(route)}${renderProxyLocations(route)}`;
+    const serverHeaders = hostRedirect ? "" : renderServerHeaders(route);
+    const proxyOpts = renderProxyOptions(route.proxy, this.nginxVersion);
+    const proxyTlsOpts = renderProxyTlsOptions(route.proxy, this.nginxVersion);
+    const webhookLocation = route.webhookProxy && !hostRedirect ? `
     location /_openship/hooks/ {
         proxy_pass ${route.webhookProxy};
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $openship_fwd_proto;
     }
 ` : "";
     const edgeLua = luaSourceAvailable();
-    const luaLogOnly = edgeLua ? `    log_by_lua_file ${LUA_LOGGER_PATH};` : "";
     const luaProxy = edgeLua ? `    log_by_lua_file ${LUA_LOGGER_PATH};
     access_by_lua_file ${RULES_GUARD_PATH};` : "";
+    const serveLocation = `    location / {
+        ${locationBody}
+    }`;
+    const redirectOrServeLocation = hostRedirect ? serveLocation : `    location / {
+        if ($openship_redirect_https) {
+            return 301 https://$server_name$request_uri;
+        }
+
+        ${locationBody}
+    }`;
+    const sharedBody = `${serverHeaders}${proxyOpts}
+${webhookLocation}${extraLocations}`;
+    const httpOnlyBlock = `# Auto-generated by Openship - do not edit manually
+server {
+    listen 80;
+    server_name ${route.domain};
+
+${FORWARD_VARS}
+
+${luaProxy}
+
+${ACME_CHALLENGE_LOCATION}
+
+${EDGE_CHALLENGE_LOCATION}
+${sharedBody}
+${serveLocation}
+}
+`;
     let serverBlock;
+    let bootstrapServed = false;
     if (route.tls && await this.certsExist(route.domain)) {
       const certPath = join(this.certDir, route.domain, "fullchain.pem");
       const keyPath = join(this.certDir, route.domain, "privkey.pem");
@@ -598,45 +910,69 @@ server {
     listen 80;
     server_name ${route.domain};
 
-${luaLogOnly}
+${FORWARD_VARS}
+
+${luaProxy}
 
 ${ACME_CHALLENGE_LOCATION}
 
-    location / {
-        return 301 https://$server_name$request_uri;
-    }
+${EDGE_CHALLENGE_LOCATION}
+${sharedBody}
+${redirectOrServeLocation}
 }
 
 server {
     listen 443 ssl;
     server_name ${route.domain};
 
+${FORWARD_VARS}
+
 ${luaProxy}
 
     ssl_certificate ${certPath};
-    ssl_certificate_key ${keyPath};
-${serverHeaders}${proxyOpts}
-${webhookLocation}${extraLocations}
-    location / {
-        ${locationBody}
-    }
+    ssl_certificate_key ${keyPath};${proxyTlsOpts}
+${sharedBody}
+${serveLocation}
 }
 `;
-    } else {
-      serverBlock = `# Auto-generated by Openship - do not edit manually
+    } else if (route.tls && route.terminatesTlsLocally) {
+      const bootstrap = await this.ensureBootstrapCert(route.domain);
+      bootstrapServed = !!bootstrap;
+      serverBlock = bootstrap ? `# Auto-generated by Openship - do not edit manually
+# openship-bootstrap-tls: ${route.domain} is serving a TEMPORARY self-signed
+# certificate because its real certificate has not been issued yet. Openship
+# replaces this file automatically once it lands. Do not adopt this material.
 server {
     listen 80;
     server_name ${route.domain};
 
+${FORWARD_VARS}
+
 ${luaProxy}
-${serverHeaders}${proxyOpts}
+
 ${ACME_CHALLENGE_LOCATION}
-${webhookLocation}${extraLocations}
-    location / {
-        ${locationBody}
-    }
+
+${EDGE_CHALLENGE_LOCATION}
+${sharedBody}
+${serveLocation}
 }
-`;
+
+server {
+    listen 443 ssl;
+    server_name ${route.domain};
+
+${FORWARD_VARS}
+
+${luaProxy}
+
+    ssl_certificate ${bootstrap.certPath};
+    ssl_certificate_key ${bootstrap.keyPath};${proxyTlsOpts}
+${sharedBody}
+${serveLocation}
+}
+` : httpOnlyBlock;
+    } else {
+      serverBlock = httpOnlyBlock;
     }
     const snapshot = await this._captureFile(configPath);
     await this._writeFile(configPath, serverBlock);
@@ -647,11 +983,32 @@ ${webhookLocation}${extraLocations}
       await this.reload().catch(() => void 0);
       throw err;
     }
+    if (!bootstrapServed) {
+      await this._rm(this.bootstrapCertDir(route.domain)).catch(() => void 0);
+    }
     await this._writeFile(this.routeStatePath(slug), JSON.stringify(route)).catch(() => void 0);
   }
   routeStatePath(slug) {
     return join(this.sitesDir, `${slug}.route.json`);
   }
+  /**
+   * Recover the proxy tunables from a vhost we already wrote, for the legacy
+   * no-sidecar re-register below. Rewriting the conf without them would silently
+   * revert a site to nginx's 1 MB / 60 s defaults as a side effect of issuing a
+   * certificate — the one moment an operator is least likely to look for it.
+   *
+   * Same table as the renderer, read backwards, so the two cannot drift.
+   */
+  scrapeProxySettings(conf) {
+    const found = {};
+    for (const spec of PROXY_DIRECTIVES) {
+      const m = conf.match(new RegExp(`^\\s*${spec.directive}\\s+([^;\\n]+);`, "m"));
+      if (!m?.[1]) continue;
+      const parsed = parseProxyValue(spec, m[1].trim());
+      if (parsed !== void 0) found[spec.key] = parsed;
+    }
+    return sanitizeProxySettings(found);
+  }
   /**
    * Remove a route by deleting its conf + route-state files, then reload.
    *
@@ -664,7 +1021,7 @@ ${webhookLocation}${extraLocations}
    */
   async removeRoute(domain) {
     assertValidDomain(domain);
-    const slug = this.domainSlug(domain);
+    const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     const statePath = this.routeStatePath(slug);
     const confSnapshot = await this._captureFile(configPath);
@@ -679,6 +1036,77 @@ ${webhookLocation}${extraLocations}
       await this.reload().catch(() => void 0);
       throw err;
     }
+    await this._rm(this.bootstrapCertDir(domain)).catch(() => void 0);
+  }
+  // ── Edge-target challenge ────────────────────────────────────────────
+  /** Filename for a host's challenge vhost. The leading `_` is a namespace
+   *  `resolveSlug` can never produce (`domainSlug` emits only `[A-Za-z0-9-]`), so no
+   *  `registerRoute`/`removeRoute` for any domain can overwrite or delete it —
+   *  matching the existing `_default.conf` / `_management.conf` convention. */
+  challengeVhostPath(host) {
+    return join(this.sitesDir, `_oblien-challenge-${this.domainSlug(host)}.conf`);
+  }
+  /**
+   * Make `host` able to answer edge-target challenges, and serve any tokens given.
+   *
+   * Called TWO ways, and the split is the point:
+   *   - `{ host }` alone, from edge-ensure (install + every deploy) — writes only the
+   *     vhost, so the box can answer before any verification exists.
+   *   - `{ host, tokens }`, from the verify flow — writes the token files too.
+   *
+   * That the first form is possible at all is what makes this ready from first
+   * install rather than only once a challenge is in flight: the location serves a
+   * DIRECTORY, so it is valid with nothing in it (a missing token is a 404, which is
+   * the right answer). And because the vhost lands in the bind-mounted sites-enabled
+   * written by our own code, it works on ANY edge image — including one predating
+   * this feature, and including a rollback. The baked image's catch-all cannot make
+   * that claim, which is why it is not the mechanism.
+   *
+   * Idempotent: skips the vhost write AND the reload when what is on disk already
+   * matches, so re-asserting on every deploy costs a couple of stats.
+   *
+   * `tokens` is a list because a re-issued verification resets the token while an
+   * older record may still be probed, and because two orgs can target one box. All
+   * are served; none is ever removed — Oblien re-probes the SAME token near its
+   * 90-day expiry, so dropping one silently kills that route ~83 days later.
+   */
+  async serveEdgeChallenge(input) {
+    const host = input.host.trim().toLowerCase().replace(/\.$/, "");
+    assertValidDomain(host);
+    const tokens = input.tokens ?? [];
+    for (const token of tokens) assertValidChallengeToken(token);
+    for (const token of tokens) {
+      await this._writeFile(join(this.challengeDir, token), token);
+    }
+    const base = this.domainSlug(host);
+    for (const stem of [base, `${base}-${this.slugSuffix(host)}`]) {
+      const path2 = join(this.sitesDir, `${stem}.conf`);
+      const conf = await this._readFile(path2).catch(() => "");
+      if (!conf || !this.serverNamesIn(conf).includes(host)) continue;
+      if (conf.includes(`location ${EDGE_CHALLENGE_URL_PREFIX}`)) {
+        return { served: true, via: "existing-vhost" };
+      }
+      return {
+        served: false,
+        via: null,
+        claimedBy: path2,
+        reason: `${host} is already served by ${path2}, which predates edge-target challenge support. Re-register that domain (a deploy or a Domains-tab save) to refresh its vhost, then retry.`
+      };
+    }
+    const vhost = edgeChallengeVhostConf(host);
+    const path = this.challengeVhostPath(host);
+    const existing = await this._readFile(path).catch(() => "");
+    if (existing === vhost) return { served: true, via: "challenge-vhost" };
+    const snapshot = await this._captureFile(path);
+    await this._writeFile(path, vhost);
+    try {
+      await this.reload();
+    } catch (err) {
+      await this._restoreFile(path, snapshot);
+      await this.reload().catch(() => void 0);
+      throw err;
+    }
+    return { served: true, via: "challenge-vhost" };
   }
   // ── SSL ──────────────────────────────────────────────────────────────
   /**
@@ -705,8 +1133,10 @@ ${webhookLocation}${extraLocations}
     const validEmail = !!this.acmeEmail && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(this.acmeEmail);
     const emailArgs = validEmail ? ["--email", this.acmeEmail] : ["--register-unsafely-without-email"];
     let certonlyOut = "";
+    const eabConfig = await this.createEphemeralEabConfig();
     try {
       certonlyOut = await this._execCertbot([
+        ...eabConfig ? ["--config", eabConfig] : [],
         "certonly",
         "--standalone",
         "--http-01-port",
@@ -715,17 +1145,21 @@ ${webhookLocation}${extraLocations}
         domain,
         "-d",
         domain,
+        ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
+        ...acmeKeyArgs(this.acmeKeyType),
         ...emailArgs,
-        "--agree-tos",
+        ...this.acmeTosAgreed ? ["--agree-tos"] : [],
         "--non-interactive",
         // Forced reissue: certbot would otherwise print "not due for renewal"
         // (exit 0) when a lineage exists, leaving the stale cert in place.
         ...opts?.force ? ["--force-renewal"] : []
       ], opts?.onLog);
     } catch (err) {
-      throw new Error(summarizeCertbotFailure(safeErrorMessage(err), domain));
+      throw new Error(summarizeCertbotFailure(this.redactAcmeSecrets(safeErrorMessage(err)), domain));
+    } finally {
+      if (eabConfig) await this._rm(dirname(eabConfig)).catch(() => void 0);
     }
-    const slug = this.domainSlug(domain);
+    const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     try {
       const state = await this._readFile(this.routeStatePath(slug));
@@ -736,9 +1170,15 @@ ${webhookLocation}${extraLocations}
     }
     try {
       const existing = await this._readFile(configPath);
+      const scraped = this.scrapeProxySettings(existing);
       const targetMatch = existing.match(/proxy_pass\s+([^;]+);/);
       if (targetMatch) {
-        await this.registerRoute({ domain, targetUrl: targetMatch[1], tls: true });
+        await this.registerRoute({
+          domain,
+          targetUrl: targetMatch[1],
+          tls: true,
+          ...scraped ? { proxy: scraped } : {}
+        });
         return this.ensureIssued(domain, certonlyOut);
       }
       const rootMatch = existing.match(/root\s+([^;]+);/);
@@ -747,7 +1187,8 @@ ${webhookLocation}${extraLocations}
           domain,
           staticRoot: rootMatch[1],
           staticRootAdopted: true,
-          tls: true
+          tls: true,
+          ...scraped ? { proxy: scraped } : {}
         });
         return this.ensureIssued(domain, certonlyOut);
       }
@@ -759,17 +1200,25 @@ ${webhookLocation}${extraLocations}
    * After a certbot run that DIDN'T throw, confirm a usable cert actually landed
    * at the expected path. certbot can exit 0 while producing nothing readable
    * there (a lineage written elsewhere, "not due for renewal", 0 domains
-   * authenticated) — a silent `{missing}` hides why. Surface certbot's real
-   * output so the operator sees the actual reason instead of a generic message.
+   * authenticated) — a silent `{missing}` hides why.
+   *
+   * The exit code plus this read of `live/<domain>` is the WHOLE verdict. certbot's
+   * stdout is evidence for the operator, never the test: a zero-exit run ends with
+   * the donation footer, and running the failure summarizer over it reported
+   * "Donating to ISRG / Let's Encrypt: …" as the cause of a cert that had in fact
+   * been issued. Only a diagnosis that matches a KNOWN failure shape is quoted.
    */
   async ensureIssued(domain, certbotOutput) {
     const result = await this.readCertInfo(domain);
     if (result.verified) return result;
+    const dir = join(this.certDir, domain);
+    const onDisk = result.reason === "read_error" ? `a certificate is at ${dir} but couldn't be read (permissions, or a partial write)` : result.reason === "invalid" ? `the certificate at ${dir} isn't usable for ${domain} (expired, wrong hostname, or the key doesn't match)` : `no certificate is at ${dir}`;
+    const diagnosis = certbotDiagnosis(certbotOutput, domain);
     const tail = certbotOutput.trim().slice(-1200);
     throw new Error(
-      summarizeCertbotFailure(certbotOutput, domain) + (tail ? `
+      `certbot exited without an error but ${onDisk}.` + (diagnosis ? ` ${diagnosis}` : "") + (tail ? `
 
-certbot exited without an error but no readable certificate is at ${join(this.certDir, domain)}. certbot said:
+certbot said:
 ${tail}` : "")
     );
   }
@@ -784,7 +1233,16 @@ ${tail}` : "")
     if (!await this.hasCertbotLineage(domain)) {
       return this.provisionCert(domain, { force: true });
     }
-    await this._exec("certbot", ["renew", "--cert-name", domain, "--non-interactive"]);
+    if (!await this.lineageServerMatches(domain)) {
+      return this.provisionCert(domain, { force: true });
+    }
+    await this._execCertbot([
+      "renew",
+      "--cert-name",
+      domain,
+      ...acmeKeyArgs(this.acmeKeyType),
+      "--non-interactive"
+    ]);
     await this.reload();
     return this.readCertInfo(domain);
   }
@@ -794,9 +1252,31 @@ ${tail}` : "")
    * reads on every `renew`, so its presence is the authoritative answer — the cert
    * FILES existing is not (they can be adopted, or copied in by hand).
    */
+  renewalConfPath(domain) {
+    return join(dirname(this.certDir), "renewal", `${domain}.conf`);
+  }
   async hasCertbotLineage(domain) {
-    const renewalPath = join(dirname(this.certDir), "renewal", `${domain}.conf`);
-    return this._exists(renewalPath);
+    return this._exists(this.renewalConfPath(domain));
+  }
+  /**
+   * Was this lineage issued by the CURRENTLY configured ACME directory? The
+   * renewal conf records the issuing `server`, and `certbot renew` only holds an
+   * account for THAT server — after the operator points at a different CA, renewing
+   * a pre-switch lineage would need an account registration `renew` cannot perform
+   * (and EAB material it is never given). An unreadable/unparsable conf answers
+   * `true` so the plain renew still runs and surfaces certbot's own error.
+   */
+  async lineageServerMatches(domain) {
+    let conf;
+    try {
+      conf = await this._readFile(this.renewalConfPath(domain));
+    } catch {
+      return true;
+    }
+    const recorded = conf.match(/^\s*server\s*=\s*(\S+)\s*$/m)?.[1];
+    if (!recorded) return true;
+    const effective = this.acmeDirectoryUrl ?? LETSENCRYPT_PRODUCTION_DIRECTORY;
+    return recorded === effective;
   }
   /**
    * Install an operator-supplied or adopted certificate (no ACME). Validates the
@@ -816,7 +1296,7 @@ ${tail}` : "")
     const { expiresAt } = candidate.cert;
     const dir = join(this.certDir, domain);
     await this.stageCertDir(dir, cert);
-    const slug = this.domainSlug(domain);
+    const slug = await this.resolveSlug(domain);
     try {
       const state = await this._readFile(this.routeStatePath(slug));
       const saved = JSON.parse(state);
@@ -832,9 +1312,87 @@ ${tail}` : "")
     };
   }
   // ── Helpers ──────────────────────────────────────────────────────────
+  /**
+   * Filename stem for a domain. NOT injective — see `resolveSlug`.
+   *
+   * Kept exactly as-is on purpose: it names every vhost file on every existing
+   * install, so changing it would rename the lot and leave the old names behind
+   * still serving. `resolveSlug` handles the collisions instead.
+   */
   domainSlug(domain) {
     return domain.replace(/[^a-zA-Z0-9-]/g, "-").replace(/-+/g, "-");
   }
+  /** Deterministic per-domain disambiguator for a slug collision. */
+  slugSuffix(domain) {
+    return createHash("sha1").update(domain).digest("hex").slice(0, 8);
+  }
+  /** Every `server_name` token declared in a vhost body. */
+  serverNamesIn(conf) {
+    const names = [];
+    for (const m of conf.matchAll(/server_name\s+([^;]+);/g)) {
+      for (const tok of m[1].trim().split(/\s+/)) {
+        if (tok) names.push(tok.toLowerCase().replace(/\.$/, ""));
+      }
+    }
+    return names;
+  }
+  /**
+   * The slug THIS domain's files live under.
+   *
+   * `domainSlug` folds every non-alphanumeric to `-`, so a dot and a literal dash
+   * collapse together and two different, separately-claimable hostnames land on
+   * one filename:
+   *
+   *     staging.app.example.com  ->  staging-app-example-com
+   *     staging-app.example.com  ->  staging-app-example-com
+   *
+   * Both are ordinary hostnames and can belong to different projects — even
+   * different orgs, since one edge fronts the whole box. Whichever registered last
+   * silently overwrote the other's vhost, and the loser's traffic fell through to
+   * `default_server`: a silent outage of somebody else's domain. `removeRoute` on
+   * either one deleted the shared file and took out both.
+   *
+   * Resolution, in this order, and the order is the whole correctness argument:
+   *
+   *   1. A disambiguated file for this domain already exists → keep using it.
+   *      MUST come first. If the incumbent is later removed, step 3 would hand
+   *      this domain the now-free base name while its real conf stayed on disk
+   *      under the suffixed name — two files serving one hostname, which is the
+   *      exact orphan class this whole change exists to remove.
+   *   2. The base file exists and does NOT list this domain in its `server_name`
+   *      → it is someone else's. Take a suffixed name; the incumbent is untouched.
+   *   3. Otherwise the base name is ours (free, or already ours).
+   *
+   * Containment, not equality, in step 2 — and the reason is narrower than it
+   * looks. Everything WE write carries exactly one `server_name` (see the server
+   * blocks above), and a takeover fans out one `registerRoute` per hostname
+   * (`registerImportedSites`), so no Openship-managed conf ever lists two. The
+   * only file that can is one the operator placed in `sites-enabled` themselves.
+   *
+   * For that file, reusing it is the lesser evil, not a free win: we rewrite it
+   * with a single `server_name`, so a sibling hostname it also served stops being
+   * served. The alternative is worse — a second vhost answering a name the first
+   * one already claims makes OpenResty warn "conflicting server name" and silently
+   * keep the FIRST, so the route we were asked to create would not take effect at
+   * all. Losing the sibling is at least the outcome the caller asked for.
+   */
+  async resolveSlug(domain) {
+    const base = this.domainSlug(domain);
+    const suffixed = `${base}-${this.slugSuffix(domain)}`;
+    const host = domain.toLowerCase().replace(/\.$/, "");
+    if (await this._exists(join(this.sitesDir, `${suffixed}.conf`)).catch(() => false)) {
+      return suffixed;
+    }
+    const basePath = join(this.sitesDir, `${base}.conf`);
+    if (await this._exists(basePath).catch(() => false)) {
+      const conf = await this._readFile(basePath).catch(() => "");
+      if (conf) {
+        const names = this.serverNamesIn(conf);
+        if (names.length > 0 && !names.includes(host)) return suffixed;
+      }
+    }
+    return base;
+  }
   /**
    * Re-detect OpenResty paths and reload.
    *
@@ -848,7 +1406,10 @@ ${tail}` : "")
         try {
           const freshPaths = await detectOpenRestyPaths(this.executor);
           this.sitesDir = freshPaths.sitesDir;
-          this.reloadCommand = buildReloadCommand(freshPaths);
+          this.nginxVersion = freshPaths.nginxVersion ?? this.nginxVersion;
+          this.reloadCommand = buildReloadCommand(freshPaths, {
+            containerEdge: this.containerEdge
+          });
         } catch {
         }
       }
@@ -1059,7 +1620,10 @@ export {
   isSafeCertPath,
   readDeclaredPair,
   renderProxyOptions,
+  renderProxyTlsOptions,
   renderGeoEntries,
+  acmeKeyArgs,
+  assertValidChallengeToken,
   MANAGED_STATIC_BASE,
   summarizeCertbotFailure,
   NginxProvider