openship 0.5.0 → 0.6.0

package/dist/{chunk-RB35YN3J.js → chunk-QEH4QUBX.js}

@@ -1,25 +1,40 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  sq
-} from "./chunk-FPRHYBY2.js";
+  edgeDownExplanation,
+  explainEdgeDown,
+  isEdgeDownFailure
+} from "./chunk-I3DPMTSF.js";
+import {
+  edgeFailureReason
+} from "./chunk-VZ2ZHPS2.js";
 import {
   ACME_CHALLENGE_LOCATION,
   ACME_HTTP01_PORT,
+  EDGE_CHALLENGE_DIR,
+  EDGE_CHALLENGE_LOCATION,
+  EDGE_CHALLENGE_URL_PREFIX,
   LUA_LOGGER_PATH,
   RULES_GUARD_PATH,
   buildReloadCommand,
   detectOpenRestyPaths,
+  edgeChallengeVhostConf,
   luaSourceAvailable
-} from "./chunk-EAAGSQXN.js";
+} from "./chunk-OGY63DGD.js";
+import {
+  logEntry,
+  sq
+} from "./chunk-ZFJXPCQP.js";
 import {
-  PROXY_GZIP_TYPES,
+  PROXY_DIRECTIVES,
+  parseProxyValue,
+  resolveProxyDirectives,
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-UMQP7SYT.js";
+} from "./chunk-OTLSJYAC.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -34,7 +49,7 @@ import {
 import { execFile as cpExecFile } from "child_process";
 import { createHash, randomBytes } from "crypto";
 import { promisify } from "util";
-import { dirname, join } from "path";
+import { posix as edgePath } from "path";
 
 // ../../packages/adapters/src/system/proxy/cert-material.ts
 import { X509Certificate, createPrivateKey } from "crypto";
@@ -43,6 +58,15 @@ import { X509Certificate, createPrivateKey } from "crypto";
 function containerCommand(container, command) {
   return `docker exec ${sq(container)} sh -c ${sq(command)}`;
 }
+async function diagnoseEdgeDown(inner, container) {
+  const status = await inner.exec(`docker inspect -f '{{.State.Status}}' ${sq(container)} 2>/dev/null`).catch(() => null);
+  const logs = await inner.exec(`docker logs --tail 40 ${sq(container)} 2>&1`).catch(() => null);
+  return explainEdgeDown({
+    container,
+    status: status?.trim() || null,
+    reason: logs ? edgeFailureReason(logs) : null
+  });
+}
 function resolveRef(ref) {
   return typeof ref === "function" ? ref() : ref;
 }
@@ -69,8 +93,34 @@ async function writeEdgeFileIn(inner, container, path, content) {
 function edgeContainerExecutor(inner, container, opts) {
   const inContainer = (command) => containerCommand(container, command);
   const overrides = {
-    exec: (command, execOpts) => inner.exec(inContainer(command), execOpts),
-    streamExec: (command, onLog) => inner.streamExec(inContainer(command), onLog),
+    // Both command paths enrich a "the container isn't up" failure with the
+    // container's name, state and `[emerg]` — see `diagnoseEdgeDown`. Gated on the
+    // narrow daemon/nginx signatures (`isEdgeDownFailure`), because a non-zero exit
+    // is ordinary here: the container-file probes report a missing path that way, and
+    // paying two `docker` round-trips per miss would be a real cost on every read.
+    exec: async (command, execOpts) => {
+      try {
+        return await inner.exec(inContainer(command), execOpts);
+      } catch (err) {
+        const message = err?.message ?? String(err);
+        if (!isEdgeDownFailure(message)) throw err;
+        throw new Error(`${await diagnoseEdgeDown(inner, container)}
+${message}`);
+      }
+    },
+    // streamExec REPORTS failure instead of throwing it, and its callers build the
+    // error they raise out of what was streamed (`_execCertbot` accumulates the log
+    // lines and throws that text). So the explanation has to go through `onLog` to
+    // reach them — appending it only to the return value would leave certbot's
+    // caller raising the daemon's bare container id, which is the original bug.
+    streamExec: async (command, onLog, opts2) => {
+      const result = await inner.streamExec(inContainer(command), onLog, opts2);
+      if (result.code === 0 || !isEdgeDownFailure(result.output)) return result;
+      const explanation = await diagnoseEdgeDown(inner, container);
+      onLog(logEntry(explanation, "error"));
+      return { code: result.code, output: `${explanation}
+${result.output}` };
+    },
     // A rename is a FILE op, so it follows the files, never the commands. Stated
     // here rather than left to the Proxy's passthrough: if the inner executor has no
     // `rename`, the fallback must still be the INNER shell (the host) — routing it
@@ -254,6 +304,7 @@ async function probeStaticOutput(executor, servedPath) {
 }
 
 // ../../packages/adapters/src/infra/nginx.ts
+var { dirname, join } = edgePath;
 var PROXY_HEADERS = `proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -301,27 +352,20 @@ function renderServerHeaders(route) {
   return lines.length > 0 ? `
 ${lines.join("\n")}` : "";
 }
-function renderProxyOptions(proxy) {
-  const p = sanitizeProxySettings(proxy);
-  if (!p) return "";
-  const lines = [];
-  if (p.clientMaxBodySize) lines.push(`    client_max_body_size ${p.clientMaxBodySize};`);
-  if (p.proxyReadTimeout) lines.push(`    proxy_read_timeout ${p.proxyReadTimeout};`);
-  if (p.proxySendTimeout) lines.push(`    proxy_send_timeout ${p.proxySendTimeout};`);
-  if (p.clientBodyTimeout) lines.push(`    client_body_timeout ${p.clientBodyTimeout};`);
-  if (p.proxyBuffering !== void 0) {
-    lines.push(`    proxy_buffering ${p.proxyBuffering ? "on" : "off"};`);
-  }
-  if (p.gzip !== void 0) {
-    lines.push(`    gzip ${p.gzip ? "on" : "off"};`);
-    if (p.gzip) {
-      lines.push(`    gzip_types ${PROXY_GZIP_TYPES};`);
-      lines.push(`    gzip_min_length 1024;`);
-    }
-  }
+function renderProxyDirectives(proxy, opts) {
+  const lines = resolveProxyDirectives(proxy, {
+    scope: opts.tlsOnly ? "tls" : "shared",
+    ...opts.nginxVersion !== void 0 ? { nginxVersion: opts.nginxVersion } : {}
+  }).map((d) => `    ${d.directive} ${d.text};`);
   return lines.length > 0 ? `
 ${lines.join("\n")}` : "";
 }
+function renderProxyOptions(proxy, nginxVersion) {
+  return renderProxyDirectives(proxy, { tlsOnly: false, nginxVersion });
+}
+function renderProxyTlsOptions(proxy, nginxVersion) {
+  return renderProxyDirectives(proxy, { tlsOnly: true, nginxVersion });
+}
 function renderGeoEntries(whitelist) {
   const entries = [
     "        default         0;",
@@ -336,6 +380,46 @@ function renderGeoEntries(whitelist) {
   return entries;
 }
 var DEFAULT_CERT_DIR = "/etc/letsencrypt/live";
+var LETSENCRYPT_PRODUCTION_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";
+function assertValidAcmeOptions(opts) {
+  if (!!opts.acmeEabKid !== !!opts.acmeEabHmacKey) {
+    throw new Error("ACME EAB requires both a key identifier and an HMAC key");
+  }
+  if (opts.acmeDirectoryUrl) {
+    let directory;
+    try {
+      directory = new URL(opts.acmeDirectoryUrl);
+    } catch {
+      throw new Error("ACME directory must be a valid http(s) URL");
+    }
+    if (directory.protocol !== "https:" && directory.protocol !== "http:") {
+      throw new Error("ACME directory must use http or https");
+    }
+  }
+  if (opts.acmeEabKid && (!/^[\x20-\x7E]+$/.test(opts.acmeEabKid) || opts.acmeEabKid.length > 512)) {
+    throw new Error("ACME EAB key identifier must be printable ASCII (maximum 512 characters)");
+  }
+  if (opts.acmeEabHmacKey && !/^[A-Za-z0-9_-]+={0,2}$/.test(opts.acmeEabHmacKey)) {
+    throw new Error("ACME EAB HMAC key must be base64url encoded");
+  }
+  if (opts.acmeCaBundle && !opts.acmeCaBundle.startsWith("/")) {
+    throw new Error("ACME CA bundle must be an absolute path in the Certbot environment");
+  }
+}
+function acmeKeyArgs(keyType) {
+  switch (keyType) {
+    case "ec256":
+      return ["--key-type", "ecdsa", "--elliptic-curve", "secp256r1"];
+    case "ec384":
+      return ["--key-type", "ecdsa", "--elliptic-curve", "secp384r1"];
+    case "rsa2048":
+      return ["--key-type", "rsa", "--rsa-key-size", "2048"];
+    case "rsa4096":
+      return ["--key-type", "rsa", "--rsa-key-size", "4096"];
+    default:
+      return [];
+  }
+}
 var DOMAIN_RE = /^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
 function assertValidDomain(domain) {
   if (!DOMAIN_RE.test(domain) || domain.length > 253) {
@@ -353,6 +437,12 @@ function assertValidUpstream(targetUrl) {
     throw new Error(`Invalid proxy target (must be http/https URL): ${targetUrl}`);
   }
 }
+var CHALLENGE_TOKEN_RE = /^[A-Za-z0-9][A-Za-z0-9._~-]{7,127}$/;
+function assertValidChallengeToken(token) {
+  if (!CHALLENGE_TOKEN_RE.test(token) || token.includes("..")) {
+    throw new Error(`Invalid edge-target challenge token: ${token}`);
+  }
+}
 var MANAGED_STATIC_BASE = "/opt/openship";
 function assertValidStaticRoot(root, opts) {
   assertNoNginxInjection(root, "static root");
@@ -369,50 +459,83 @@ function assertValidStaticRoot(root, opts) {
 }
 var execFileAsync = promisify(cpExecFile);
 function summarizeCertbotFailure(output, domain) {
+  const edgeDown = edgeDownExplanation(output);
+  if (edgeDown) return edgeDown;
+  const structured = certbotDiagnosis(output, domain);
+  if (structured) return structured;
+  const lines = (output || "").split("\n").map((l) => l.trim()).filter(Boolean);
+  return lines.slice(-3).join(" \xB7 ") || `certbot failed to issue a certificate for ${domain}`;
+}
+function certbotDiagnosis(output, domain) {
   const text = output || "";
   const pick = (re) => text.match(re)?.[0]?.replace(/\s+/g, " ").trim();
   const detail = pick(/Detail:\s*[^\n]+/i);
   const hint = pick(/Hint:\s*[^\n]+/i);
+  const challengeUrl = pick(/https?:\/\/\S*\.well-known\/acme-challenge\/\S*/i);
+  const redirectedToHttps = /^https:/i.test(challengeUrl ?? "");
   let diagnosis;
   if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
   } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
-  } else if (/\b52[56]\b|ssl handshake failed|cloudflare/i.test(text)) {
+  } else if (/\b52[56]\b|ssl handshake failed/i.test(text)) {
     diagnosis = `Cloudflare's proxy is answering the certificate challenge for ${domain} instead of forwarding it to this server: it redirects the request to HTTPS, then rejects the origin's TLS. Fix it one of three ways \u2014 set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record until it is, or upload a Cloudflare Origin CA certificate from the Domains tab and skip Let's Encrypt entirely.`;
   } else if (/404|invalid response|unauthorized|"?status"?:?\s*40\d/i.test(text)) {
-    diagnosis = `Port 80 answered but not with our ACME challenge \u2014 another web server is still serving :80, so the takeover didn't complete. Re-run and choose take-over / migrate.`;
+    diagnosis = redirectedToHttps ? `The challenge for ${domain} was redirected from HTTP to HTTPS and then answered with a 404 \u2014 so whatever served it isn't routing that hostname. If ${domain} is behind Cloudflare, its "Always Use HTTPS" is doing the redirect: set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record. Otherwise check the A record points at this server and the domain is registered here. Nothing is occupying :80, so take-over / migrate will not help.` : `Port 80 answered but not with our ACME challenge \u2014 another web server is still serving :80, so the takeover didn't complete. Re-run and choose take-over / migrate.`;
   } else if (/too many certificates|rateLimited|rate limit/i.test(text)) {
     diagnosis = `Let's Encrypt rate limit reached for ${domain} \u2014 wait before retrying.`;
   }
   const parts = [diagnosis, detail, hint].filter(Boolean);
-  if (parts.length > 0) return parts.join(" \u2014 ");
-  const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
-  return lines.slice(-3).join(" \xB7 ") || `certbot failed to issue a certificate for ${domain}`;
+  return parts.length > 0 ? parts.join(" \u2014 ") : void 0;
 }
 var NginxProvider = class {
   sitesDir;
   acmeEmail;
+  acmeDirectoryUrl;
+  acmeEabKid;
+  acmeEabHmacKey;
+  acmeKeyType;
+  acmeCaBundle;
+  acmeTosAgreed;
   certDir;
   executor;
   reloadCommand;
   pinPaths;
   containerEdge;
+  challengeDir;
+  /**
+   * nginx version of the edge, when `detectOpenRestyPaths` could read it. Gates the
+   * one directive whose syntax is version-dependent (`http2`); undefined = unknown,
+   * which `proxyDirectiveAllowed` treats as allow.
+   */
+  nginxVersion;
   constructor(opts) {
+    assertValidAcmeOptions(opts);
     this.sitesDir = opts.paths.sitesDir;
+    this.nginxVersion = opts.paths.nginxVersion;
     this.acmeEmail = opts.acmeEmail;
+    this.acmeDirectoryUrl = opts.acmeDirectoryUrl;
+    this.acmeEabKid = opts.acmeEabKid;
+    this.acmeEabHmacKey = opts.acmeEabHmacKey;
+    this.acmeKeyType = opts.acmeKeyType;
+    this.acmeCaBundle = opts.acmeCaBundle;
+    this.acmeTosAgreed = opts.acmeTosAgreed ?? true;
     this.certDir = opts.certDir ?? DEFAULT_CERT_DIR;
     this.executor = opts.executor ?? null;
     this.containerEdge = opts.containerEdge ?? false;
     this.reloadCommand = buildReloadCommand(opts.paths, { containerEdge: this.containerEdge });
     this.pinPaths = opts.pinPaths ?? false;
+    this.challengeDir = opts.challengeDir ?? EDGE_CHALLENGE_DIR;
   }
   // ── File operation helpers (dual-path: local or remote) ──────────────
-  async _writeFile(path, content) {
+  async _writeFile(path, content, mode) {
     const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}`;
     if (this.executor) {
       try {
         await this.executor.writeFile(tmpPath, content);
+        if (mode !== void 0) {
+          await this.executor.exec(`chmod ${sq(mode.toString(8))} ${sq(tmpPath)}`);
+        }
         if (this.executor.rename) {
           await this.executor.rename(tmpPath, path);
         } else {
@@ -425,7 +548,7 @@ var NginxProvider = class {
     } else {
       await fsMkdir(dirname(path), { recursive: true });
       try {
-        await fsWriteFile(tmpPath, content, "utf-8");
+        await fsWriteFile(tmpPath, content, { encoding: "utf-8", mode });
         await fsRename(tmpPath, path);
       } catch (err) {
         await fsRm(tmpPath).catch(() => void 0);
@@ -511,14 +634,22 @@ var NginxProvider = class {
    * issued anything.
    *
    * Why a missing :443 block is a hard failure, not a soft one: an unmatched SNI
-   * falls through to the edge's `ssl_reject_handshake` default (correct — it stops
-   * unrouted hosts being cross-served someone else's cert). But that means the
-   * origin REFUSES the handshake for a domain we do route. Behind Cloudflare's
-   * proxy every visitor sees error 525, and issuance deadlocks: Cloudflare answers
-   * the HTTP-01 challenge with a 301 to https, then can't reach an origin that
-   * refuses TLS, so the challenge fails and the vhost stays HTTP-only — forever
-   * (#308). A placeholder breaks the loop: Cloudflare "Full" accepts it, the
-   * challenge completes, and the real cert takes over.
+   * falls through to the edge's :443 catch-all, which answers with the "service not
+   * found" page (#431) under a placeholder certificate that belongs to no domain.
+   * For a domain we DO route that is a broken site: the visitor is told nothing is
+   * deployed here, and behind Cloudflare "Full" — which accepts any origin cert —
+   * they get that page rather than the app. Issuance deadlocks with it: Cloudflare
+   * answers the HTTP-01 challenge with a 301 to https, the catch-all deliberately
+   * carries no ACME location on :443, so the challenge 404s and the vhost stays
+   * HTTP-only — forever (#308). A per-domain placeholder breaks the loop: the
+   * domain gets its OWN name-bound :443 block, the challenge completes, and the
+   * real cert takes over.
+   *
+   * So the :443 catch-all having gained a certificate of its own does NOT make this
+   * redundant — it only changed the symptom from a raw TLS error (#431's old error
+   * 525) into a wrong page. The catch-all's cert is deliberately valid for nothing;
+   * serving it for a domain we route is the cross-serving that block exists to
+   * prevent.
    *
    * Deliberately NOT written under `certDir`: `certsExist()` / `readCertInfo()`
    * read that path, so a self-signed cert there would short-circuit provisionCert
@@ -625,19 +756,65 @@ var NginxProvider = class {
    * still sees the real cause.
    */
   async _execCertbot(args, onLog) {
+    const command = this.acmeCaBundle ? "env" : "certbot";
+    const commandArgs = this.acmeCaBundle ? [`REQUESTS_CA_BUNDLE=${this.acmeCaBundle}`, "certbot", ...args] : args;
     if (!onLog || !this.executor) {
-      const out = await this._exec("certbot", args);
-      if (out) onLog?.(out);
-      return out;
+      let out;
+      try {
+        out = await this._exec(command, commandArgs);
+      } catch (err) {
+        throw new Error(this.redactAcmeSecrets(safeErrorMessage(err)));
+      }
+      const redacted = this.redactAcmeSecrets(out);
+      if (redacted) onLog?.(redacted);
+      return redacted;
     }
-    const full = `certbot ${args.map(sq).join(" ")}`;
+    const full = `${command} ${commandArgs.map(sq).join(" ")}`;
     let output = "";
     const { code } = await this.executor.streamExec(full, (log) => {
       output += log.message;
-      onLog(log.message);
+      onLog(this.redactAcmeSecrets(log.message));
     });
-    if (code !== 0) throw new Error(output.trim() || `certbot exited ${code}`);
-    return output;
+    if (code !== 0) {
+      throw new Error(this.redactAcmeSecrets(output).trim() || `certbot exited ${code}`);
+    }
+    return this.redactAcmeSecrets(output);
+  }
+  redactAcmeSecrets(value) {
+    return this.acmeEabHmacKey ? value.split(this.acmeEabHmacKey).join("[REDACTED]") : value;
+  }
+  /**
+   * Keep EAB HMAC material out of argv/process listings and remove it after use.
+   *
+   * Same layout contract as runtime/git-ssh-material.ts (the repo's other
+   * ephemeral-secret-on-disk site): the material lives in its OWN 0700 directory
+   * with the file at 0600, the bytes never travel through a shell command line,
+   * and cleanup removes the directory as a unit. The 0700 parent goes first, so
+   * even the temp file _writeFile stages is born unreadable to other users.
+   */
+  async createEphemeralEabConfig() {
+    if (!this.acmeEabKid || !this.acmeEabHmacKey) return null;
+    const dir = join(dirname(this.certDir), `.openship-eab-${randomBytes(12).toString("hex")}`);
+    const path = join(dir, "eab.ini");
+    if (this.executor) {
+      await this.executor.mkdir(dir);
+      await this._exec("chmod", ["700", dir]);
+    } else {
+      await fsMkdir(dir, { recursive: true, mode: 448 });
+    }
+    try {
+      await this._writeFile(
+        path,
+        `eab-kid = ${this.acmeEabKid}
+eab-hmac-key = ${this.acmeEabHmacKey}
+`,
+        384
+      );
+    } catch (err) {
+      await this._rm(dir).catch(() => void 0);
+      throw err;
+    }
+    return path;
   }
   async _captureFile(path) {
     if (!await this._exists(path)) {
@@ -681,7 +858,8 @@ var NginxProvider = class {
         ${PROXY_HEADERS}`;
     const extraLocations = hostRedirect ? "" : `${renderRedirects(route)}${renderProxyLocations(route)}`;
     const serverHeaders = hostRedirect ? "" : renderServerHeaders(route);
-    const proxyOpts = renderProxyOptions(route.proxy);
+    const proxyOpts = renderProxyOptions(route.proxy, this.nginxVersion);
+    const proxyTlsOpts = renderProxyTlsOptions(route.proxy, this.nginxVersion);
     const webhookLocation = route.webhookProxy && !hostRedirect ? `
     location /_openship/hooks/ {
         proxy_pass ${route.webhookProxy};
@@ -716,6 +894,8 @@ ${FORWARD_VARS}
 ${luaProxy}
 
 ${ACME_CHALLENGE_LOCATION}
+
+${EDGE_CHALLENGE_LOCATION}
 ${sharedBody}
 ${serveLocation}
 }
@@ -735,6 +915,8 @@ ${FORWARD_VARS}
 ${luaProxy}
 
 ${ACME_CHALLENGE_LOCATION}
+
+${EDGE_CHALLENGE_LOCATION}
 ${sharedBody}
 ${redirectOrServeLocation}
 }
@@ -748,7 +930,7 @@ ${FORWARD_VARS}
 ${luaProxy}
 
     ssl_certificate ${certPath};
-    ssl_certificate_key ${keyPath};
+    ssl_certificate_key ${keyPath};${proxyTlsOpts}
 ${sharedBody}
 ${serveLocation}
 }
@@ -769,6 +951,8 @@ ${FORWARD_VARS}
 ${luaProxy}
 
 ${ACME_CHALLENGE_LOCATION}
+
+${EDGE_CHALLENGE_LOCATION}
 ${sharedBody}
 ${serveLocation}
 }
@@ -782,7 +966,7 @@ ${FORWARD_VARS}
 ${luaProxy}
 
     ssl_certificate ${bootstrap.certPath};
-    ssl_certificate_key ${bootstrap.keyPath};
+    ssl_certificate_key ${bootstrap.keyPath};${proxyTlsOpts}
 ${sharedBody}
 ${serveLocation}
 }
@@ -807,6 +991,24 @@ ${serveLocation}
   routeStatePath(slug) {
     return join(this.sitesDir, `${slug}.route.json`);
   }
+  /**
+   * Recover the proxy tunables from a vhost we already wrote, for the legacy
+   * no-sidecar re-register below. Rewriting the conf without them would silently
+   * revert a site to nginx's 1 MB / 60 s defaults as a side effect of issuing a
+   * certificate — the one moment an operator is least likely to look for it.
+   *
+   * Same table as the renderer, read backwards, so the two cannot drift.
+   */
+  scrapeProxySettings(conf) {
+    const found = {};
+    for (const spec of PROXY_DIRECTIVES) {
+      const m = conf.match(new RegExp(`^\\s*${spec.directive}\\s+([^;\\n]+);`, "m"));
+      if (!m?.[1]) continue;
+      const parsed = parseProxyValue(spec, m[1].trim());
+      if (parsed !== void 0) found[spec.key] = parsed;
+    }
+    return sanitizeProxySettings(found);
+  }
   /**
    * Remove a route by deleting its conf + route-state files, then reload.
    *
@@ -836,6 +1038,76 @@ ${serveLocation}
     }
     await this._rm(this.bootstrapCertDir(domain)).catch(() => void 0);
   }
+  // ── Edge-target challenge ────────────────────────────────────────────
+  /** Filename for a host's challenge vhost. The leading `_` is a namespace
+   *  `resolveSlug` can never produce (`domainSlug` emits only `[A-Za-z0-9-]`), so no
+   *  `registerRoute`/`removeRoute` for any domain can overwrite or delete it —
+   *  matching the existing `_default.conf` / `_management.conf` convention. */
+  challengeVhostPath(host) {
+    return join(this.sitesDir, `_oblien-challenge-${this.domainSlug(host)}.conf`);
+  }
+  /**
+   * Make `host` able to answer edge-target challenges, and serve any tokens given.
+   *
+   * Called TWO ways, and the split is the point:
+   *   - `{ host }` alone, from edge-ensure (install + every deploy) — writes only the
+   *     vhost, so the box can answer before any verification exists.
+   *   - `{ host, tokens }`, from the verify flow — writes the token files too.
+   *
+   * That the first form is possible at all is what makes this ready from first
+   * install rather than only once a challenge is in flight: the location serves a
+   * DIRECTORY, so it is valid with nothing in it (a missing token is a 404, which is
+   * the right answer). And because the vhost lands in the bind-mounted sites-enabled
+   * written by our own code, it works on ANY edge image — including one predating
+   * this feature, and including a rollback. The baked image's catch-all cannot make
+   * that claim, which is why it is not the mechanism.
+   *
+   * Idempotent: skips the vhost write AND the reload when what is on disk already
+   * matches, so re-asserting on every deploy costs a couple of stats.
+   *
+   * `tokens` is a list because a re-issued verification resets the token while an
+   * older record may still be probed, and because two orgs can target one box. All
+   * are served; none is ever removed — Oblien re-probes the SAME token near its
+   * 90-day expiry, so dropping one silently kills that route ~83 days later.
+   */
+  async serveEdgeChallenge(input) {
+    const host = input.host.trim().toLowerCase().replace(/\.$/, "");
+    assertValidDomain(host);
+    const tokens = input.tokens ?? [];
+    for (const token of tokens) assertValidChallengeToken(token);
+    for (const token of tokens) {
+      await this._writeFile(join(this.challengeDir, token), token);
+    }
+    const base = this.domainSlug(host);
+    for (const stem of [base, `${base}-${this.slugSuffix(host)}`]) {
+      const path2 = join(this.sitesDir, `${stem}.conf`);
+      const conf = await this._readFile(path2).catch(() => "");
+      if (!conf || !this.serverNamesIn(conf).includes(host)) continue;
+      if (conf.includes(`location ${EDGE_CHALLENGE_URL_PREFIX}`)) {
+        return { served: true, via: "existing-vhost" };
+      }
+      return {
+        served: false,
+        via: null,
+        claimedBy: path2,
+        reason: `${host} is already served by ${path2}, which predates edge-target challenge support. Re-register that domain (a deploy or a Domains-tab save) to refresh its vhost, then retry.`
+      };
+    }
+    const vhost = edgeChallengeVhostConf(host);
+    const path = this.challengeVhostPath(host);
+    const existing = await this._readFile(path).catch(() => "");
+    if (existing === vhost) return { served: true, via: "challenge-vhost" };
+    const snapshot = await this._captureFile(path);
+    await this._writeFile(path, vhost);
+    try {
+      await this.reload();
+    } catch (err) {
+      await this._restoreFile(path, snapshot);
+      await this.reload().catch(() => void 0);
+      throw err;
+    }
+    return { served: true, via: "challenge-vhost" };
+  }
   // ── SSL ──────────────────────────────────────────────────────────────
   /**
    * Provision a TLS certificate using certbot.
@@ -861,8 +1133,10 @@ ${serveLocation}
     const validEmail = !!this.acmeEmail && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(this.acmeEmail);
     const emailArgs = validEmail ? ["--email", this.acmeEmail] : ["--register-unsafely-without-email"];
     let certonlyOut = "";
+    const eabConfig = await this.createEphemeralEabConfig();
     try {
       certonlyOut = await this._execCertbot([
+        ...eabConfig ? ["--config", eabConfig] : [],
         "certonly",
         "--standalone",
         "--http-01-port",
@@ -871,15 +1145,19 @@ ${serveLocation}
         domain,
         "-d",
         domain,
+        ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
+        ...acmeKeyArgs(this.acmeKeyType),
         ...emailArgs,
-        "--agree-tos",
+        ...this.acmeTosAgreed ? ["--agree-tos"] : [],
         "--non-interactive",
         // Forced reissue: certbot would otherwise print "not due for renewal"
         // (exit 0) when a lineage exists, leaving the stale cert in place.
         ...opts?.force ? ["--force-renewal"] : []
       ], opts?.onLog);
     } catch (err) {
-      throw new Error(summarizeCertbotFailure(safeErrorMessage(err), domain));
+      throw new Error(summarizeCertbotFailure(this.redactAcmeSecrets(safeErrorMessage(err)), domain));
+    } finally {
+      if (eabConfig) await this._rm(dirname(eabConfig)).catch(() => void 0);
     }
     const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
@@ -892,9 +1170,15 @@ ${serveLocation}
     }
     try {
       const existing = await this._readFile(configPath);
+      const scraped = this.scrapeProxySettings(existing);
       const targetMatch = existing.match(/proxy_pass\s+([^;]+);/);
       if (targetMatch) {
-        await this.registerRoute({ domain, targetUrl: targetMatch[1], tls: true });
+        await this.registerRoute({
+          domain,
+          targetUrl: targetMatch[1],
+          tls: true,
+          ...scraped ? { proxy: scraped } : {}
+        });
         return this.ensureIssued(domain, certonlyOut);
       }
       const rootMatch = existing.match(/root\s+([^;]+);/);
@@ -903,7 +1187,8 @@ ${serveLocation}
           domain,
           staticRoot: rootMatch[1],
           staticRootAdopted: true,
-          tls: true
+          tls: true,
+          ...scraped ? { proxy: scraped } : {}
         });
         return this.ensureIssued(domain, certonlyOut);
       }
@@ -915,17 +1200,25 @@ ${serveLocation}
    * After a certbot run that DIDN'T throw, confirm a usable cert actually landed
    * at the expected path. certbot can exit 0 while producing nothing readable
    * there (a lineage written elsewhere, "not due for renewal", 0 domains
-   * authenticated) — a silent `{missing}` hides why. Surface certbot's real
-   * output so the operator sees the actual reason instead of a generic message.
+   * authenticated) — a silent `{missing}` hides why.
+   *
+   * The exit code plus this read of `live/<domain>` is the WHOLE verdict. certbot's
+   * stdout is evidence for the operator, never the test: a zero-exit run ends with
+   * the donation footer, and running the failure summarizer over it reported
+   * "Donating to ISRG / Let's Encrypt: …" as the cause of a cert that had in fact
+   * been issued. Only a diagnosis that matches a KNOWN failure shape is quoted.
    */
   async ensureIssued(domain, certbotOutput) {
     const result = await this.readCertInfo(domain);
     if (result.verified) return result;
+    const dir = join(this.certDir, domain);
+    const onDisk = result.reason === "read_error" ? `a certificate is at ${dir} but couldn't be read (permissions, or a partial write)` : result.reason === "invalid" ? `the certificate at ${dir} isn't usable for ${domain} (expired, wrong hostname, or the key doesn't match)` : `no certificate is at ${dir}`;
+    const diagnosis = certbotDiagnosis(certbotOutput, domain);
     const tail = certbotOutput.trim().slice(-1200);
     throw new Error(
-      summarizeCertbotFailure(certbotOutput, domain) + (tail ? `
+      `certbot exited without an error but ${onDisk}.` + (diagnosis ? ` ${diagnosis}` : "") + (tail ? `
 
-certbot exited without an error but no readable certificate is at ${join(this.certDir, domain)}. certbot said:
+certbot said:
 ${tail}` : "")
     );
   }
@@ -940,7 +1233,16 @@ ${tail}` : "")
     if (!await this.hasCertbotLineage(domain)) {
       return this.provisionCert(domain, { force: true });
     }
-    await this._exec("certbot", ["renew", "--cert-name", domain, "--non-interactive"]);
+    if (!await this.lineageServerMatches(domain)) {
+      return this.provisionCert(domain, { force: true });
+    }
+    await this._execCertbot([
+      "renew",
+      "--cert-name",
+      domain,
+      ...acmeKeyArgs(this.acmeKeyType),
+      "--non-interactive"
+    ]);
     await this.reload();
     return this.readCertInfo(domain);
   }
@@ -950,9 +1252,31 @@ ${tail}` : "")
    * reads on every `renew`, so its presence is the authoritative answer — the cert
    * FILES existing is not (they can be adopted, or copied in by hand).
    */
+  renewalConfPath(domain) {
+    return join(dirname(this.certDir), "renewal", `${domain}.conf`);
+  }
   async hasCertbotLineage(domain) {
-    const renewalPath = join(dirname(this.certDir), "renewal", `${domain}.conf`);
-    return this._exists(renewalPath);
+    return this._exists(this.renewalConfPath(domain));
+  }
+  /**
+   * Was this lineage issued by the CURRENTLY configured ACME directory? The
+   * renewal conf records the issuing `server`, and `certbot renew` only holds an
+   * account for THAT server — after the operator points at a different CA, renewing
+   * a pre-switch lineage would need an account registration `renew` cannot perform
+   * (and EAB material it is never given). An unreadable/unparsable conf answers
+   * `true` so the plain renew still runs and surfaces certbot's own error.
+   */
+  async lineageServerMatches(domain) {
+    let conf;
+    try {
+      conf = await this._readFile(this.renewalConfPath(domain));
+    } catch {
+      return true;
+    }
+    const recorded = conf.match(/^\s*server\s*=\s*(\S+)\s*$/m)?.[1];
+    if (!recorded) return true;
+    const effective = this.acmeDirectoryUrl ?? LETSENCRYPT_PRODUCTION_DIRECTORY;
+    return recorded === effective;
   }
   /**
    * Install an operator-supplied or adopted certificate (no ACME). Validates the
@@ -1082,6 +1406,7 @@ ${tail}` : "")
         try {
           const freshPaths = await detectOpenRestyPaths(this.executor);
           this.sitesDir = freshPaths.sitesDir;
+          this.nginxVersion = freshPaths.nginxVersion ?? this.nginxVersion;
           this.reloadCommand = buildReloadCommand(freshPaths, {
             containerEdge: this.containerEdge
           });
@@ -1295,7 +1620,10 @@ export {
   isSafeCertPath,
   readDeclaredPair,
   renderProxyOptions,
+  renderProxyTlsOptions,
   renderGeoEntries,
+  acmeKeyArgs,
+  assertValidChallengeToken,
   MANAGED_STATIC_BASE,
   summarizeCertbotFailure,
   NginxProvider