openship 0.6.7 → 0.6.8

package/dist/{chunk-VSTFHUCV.js → chunk-BO6CY4V2.js}

@@ -7,13 +7,13 @@ import {
   isContainerPortForwarder,
   managedDeploymentIdFromUnit,
   tryExec
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/port-listen.ts
-var PROC_NET_TCP_CMD = "cat /proc/net/tcp 2>/dev/null; cat /proc/net/tcp6 2>/dev/null; true";
+var PROC_NET_TCP_FILES = ["/proc/net/tcp", "/proc/net/tcp6"];
 var TCP_LISTEN = "0A";
 function parseListeningPorts(procText) {
   const ports = /* @__PURE__ */ new Set();
@@ -34,12 +34,15 @@ function parseListeningPorts(procText) {
   return ports;
 }
 async function probePortListeningOnce(executor, port) {
-  try {
-    const out = await executor.exec(PROC_NET_TCP_CMD, { timeout: 5e3 });
-    return parseListeningPorts(out).has(port);
-  } catch {
-    return null;
+  const readable = [];
+  for (const file of PROC_NET_TCP_FILES) {
+    try {
+      readable.push(await executor.exec(`cat ${file} 2>/dev/null`, { timeout: 5e3 }));
+    } catch {
+    }
   }
+  if (readable.length === 0) return null;
+  return parseListeningPorts(readable.join("\n")).has(port);
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -85,12 +88,14 @@ async function waitForPortFree(executor, port, opts = {}) {
 
 // ../../packages/adapters/src/runtime/port-conflict.ts
 async function resolveListenerOwner(executor, pid) {
-  const cgroup = await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null || true`);
+  const cgroup = (await tryExec(executor, `cat /proc/${pid}/cgroup 2>/dev/null`))?.trim();
+  if (!cgroup) return { cgroupVerified: false };
+  const evidence = { cgroupVerified: true, processCgroup: cgroup };
   const containerId = containerIdFromCgroup(cgroup);
-  if (containerId) return { containerId };
+  if (containerId) return { ...evidence, containerId };
   const systemdUnit = cgroup?.match(/(?:^|\/)([^/\n]+\.service)(?:$|\n|\/)/m)?.[1]?.trim();
   if (!systemdUnit || !/^[A-Za-z0-9@._:-]+\.service$/.test(systemdUnit)) {
-    return {};
+    return evidence;
   }
   const description = await tryExec(
     executor,
@@ -98,6 +103,7 @@ async function resolveListenerOwner(executor, pid) {
   );
   const deploymentId = managedDeploymentIdFromUnit(systemdUnit);
   return {
+    ...evidence,
     systemdUnit,
     systemdDescription: description?.trim() || void 0,
     ...deploymentId ? { deploymentId, isManagedDeployment: true } : { isManagedDeployment: false }
@@ -108,25 +114,104 @@ async function resolveListener(executor, port) {
     executor,
     `ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`
   );
-  if (out) {
-    const ssMatch = out.match(/pid=(\d+)/);
-    const lsofMatch = !ssMatch ? out.match(/^\s*(\d+)\s*$/m) : null;
-    const pid = ssMatch ? parseInt(ssMatch[1], 10) : lsofMatch ? parseInt(lsofMatch[1], 10) : null;
-    if (pid) return { pid, occupied: true };
+  const listenerPid = (output) => {
+    if (!output) return null;
+    const ssMatch = output.match(/pid=(\d+)/);
+    const lsofMatch = !ssMatch ? output.match(/^\s*(\d+)\s*$/m) : null;
+    const parsed = ssMatch?.[1] ?? lsofMatch?.[1];
+    if (!parsed) return null;
+    const pid2 = Number.parseInt(parsed, 10);
+    return Number.isSafeInteger(pid2) && pid2 > 0 ? pid2 : null;
+  };
+  const pid = listenerPid(out);
+  if (pid) return { pid, occupied: true, checked: true };
+  const observedListener = Boolean(out?.trim());
+  if (observedListener) {
+    const privilegedOut = await tryExec(
+      executor,
+      `sudo -n ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || sudo -n lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`,
+      { timeout: 5e3 }
+    );
+    const privilegedPid = listenerPid(privilegedOut);
+    if (privilegedPid) return { pid: privilegedPid, occupied: true, checked: true };
   }
   const listening = await probePortListeningOnce(executor, port);
-  return { pid: null, occupied: listening === true };
+  return {
+    pid: null,
+    occupied: observedListener || listening === true,
+    checked: observedListener || listening !== null
+  };
 }
-async function probeListeningPort(executor, port) {
+function parseListenerPids(output) {
+  const lines = (output ?? "").split("\n").map((line) => line.trim()).filter(Boolean);
+  if (lines.length === 0) return { observed: false, complete: true, pids: [] };
+  const pids = /* @__PURE__ */ new Set();
+  let complete = true;
+  for (const line of lines) {
+    const matches = [...line.matchAll(/pid=(\d+)/g)].map((match) => match[1]);
+    const bare = matches.length === 0 ? line.match(/^(\d+)$/)?.[1] : void 0;
+    const values = bare ? [bare] : matches;
+    if (values.length === 0) complete = false;
+    for (const value of values) {
+      const pid = Number.parseInt(value, 10);
+      if (Number.isSafeInteger(pid) && pid > 0) pids.add(pid);
+      else complete = false;
+    }
+  }
+  return { observed: true, complete, pids: [...pids] };
+}
+async function probeListeningPortOwners(executor, port) {
+  const command = `ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null || true`;
+  const ordinary = parseListenerPids(await tryExec(executor, command));
+  let evidence = ordinary;
+  if (ordinary.observed && !ordinary.complete) {
+    const privileged = parseListenerPids(
+      await tryExec(
+        executor,
+        `sudo -n ss -tlnp sport = :${port} 2>/dev/null | grep LISTEN || sudo -n lsof -ti tcp:${port} -sTCP:LISTEN 2>/dev/null`,
+        { timeout: 5e3 }
+      )
+    );
+    if (privileged.observed && privileged.complete) evidence = privileged;
+    else {
+      evidence = {
+        observed: true,
+        complete: false,
+        pids: [.../* @__PURE__ */ new Set([...ordinary.pids, ...privileged.pids])]
+      };
+    }
+  }
+  if (!evidence.observed) {
+    const listening = await probePortListeningOnce(executor, port);
+    if (listening === null) return { occupants: [], checked: false, ownershipComplete: false };
+    if (!listening) return { occupants: [], checked: true, ownershipComplete: true };
+    return { occupants: [], checked: true, ownershipComplete: false };
+  }
+  const described = await Promise.all(
+    evidence.pids.map((pid) => describeProcess(executor, pid).catch(() => null))
+  );
+  const occupants = described.filter((row) => row !== null);
+  return {
+    occupants,
+    checked: true,
+    ownershipComplete: evidence.complete && occupants.length === evidence.pids.length
+  };
+}
+async function probeListeningPortState(executor, port) {
   try {
-    const { pid, occupied } = await resolveListener(executor, port);
-    if (!occupied) return null;
-    if (pid === null) return { pid: null, command: "unknown listener" };
-    return await describeProcess(executor, pid);
+    const { pid, occupied, checked } = await resolveListener(executor, port);
+    if (!checked || !occupied) return { occupant: null, checked };
+    if (pid === null) {
+      return { occupant: { pid: null, command: "unknown listener" }, checked: true };
+    }
+    return { occupant: await describeProcess(executor, pid), checked: true };
   } catch {
-    return null;
+    return { occupant: null, checked: false };
   }
 }
+async function probeListeningPort(executor, port) {
+  return (await probeListeningPortState(executor, port)).occupant;
+}
 async function describeProcess(executor, pid) {
   let command = `PID ${pid}`;
   let rawCommand;
@@ -173,6 +258,7 @@ function portOccupantDetails(port, occupant, stopTarget) {
 export {
   waitForPortListening,
   waitForPortFree,
+  probeListeningPortOwners,
   probeListeningPort,
   describeProcess,
   portOccupantDetails

package/dist/{chunk-J3K6XABC.js → chunk-D3OEMXYP.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-I3DPMTSF.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   logEntry,
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   edgeFailureReason
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 
 // ../../packages/adapters/src/system/docker-edge-executor.ts
 import Dockerode from "dockerode";

package/dist/{chunk-UWEV6XTS.js → chunk-D6HU4VUZ.js}

@@ -10,7 +10,7 @@ import {
 import {
   safeErrorMessage,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/probe-exec.ts
 async function tryExec(executor, command, opts) {

package/dist/{chunk-S6B2Z3OO.js → chunk-ENKJ7XIF.js}

@@ -7,11 +7,11 @@ import {
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-MEE6OZFP.js";
+} from "./chunk-5DJOB7IX.js";
 import {
   isArtifactPathRef,
   removeManagedArtifact
-} from "./chunk-WU54BXFE.js";
+} from "./chunk-SK4FFCFR.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -24,36 +24,36 @@ import {
   splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-H4FS5BED.js";
+} from "./chunk-AHJYP7DG.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   privilegedExecutor
-} from "./chunk-PVP4RGWT.js";
+} from "./chunk-T46BQOLY.js";
 import {
   HOST_STATE_DIR,
   envOps,
   hostRefusal,
   opScript
-} from "./chunk-BLEXTYRK.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   ensureOwnedDir,
   resolveEnvironment
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   sq as sq2,
   wrapLocalBuildCommand
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   portOccupantDetails,
   probeListeningPort
-} from "./chunk-VSTFHUCV.js";
+} from "./chunk-BO6CY4V2.js";
 import {
   managedDeploymentUnitName,
   probeExec,
   withReason
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   formatDuration,
   isRemoteConnectionError,
@@ -73,7 +73,7 @@ import {
   refused,
   safeErrorMessage,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/remote-journal.ts
 var OPSH_RUN_VERSION = 1;
@@ -1608,6 +1608,16 @@ var BareRuntime = class {
   async inContainerExecutor() {
     return this.executor;
   }
+  /**
+   * Resolve a retained application release for an env-only refresh.
+   * Deployment ids originate in our database, but reject path-shaped input at
+   * this boundary so an imported/corrupt row cannot escape releases/.
+   */
+  async retainedReleaseArtifact(deploymentId) {
+    if (!deploymentId || deploymentId.includes("/") || deploymentId.includes("\\")) return null;
+    const path = this.releaseDir(deploymentId);
+    return await this.executor.exists(path).catch(() => false) ? path : null;
+  }
   /** Get or lazily initialise the process supervisor. */
   async supervisor() {
     if (this._supervisor) return this._supervisor;

package/dist/{chunk-BLEXTYRK.js → chunk-GNOMEMNI.js}

@@ -9,7 +9,7 @@ import {
   firewallPersists,
   refused,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {

package/dist/{chunk-NRTJRNAE.js → chunk-IAMOUDHY.js}

@@ -17,8 +17,9 @@ import {
   detectOpenRestyPaths,
   edgeChallengeVhostConf,
   isCloudFrontedHost,
-  luaSourceAvailable
-} from "./chunk-QHMDCYZ3.js";
+  luaSourceAvailable,
+  reloadBareOpenResty
+} from "./chunk-7PEXM2UI.js";
 import {
   edgeDownExplanation,
   explainEdgeDown,
@@ -29,17 +30,17 @@ import {
 } from "./chunk-R4VDPFLS.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   logEntry,
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   edgeFailureReason
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 import {
   probeListeningPort
-} from "./chunk-VSTFHUCV.js";
+} from "./chunk-BO6CY4V2.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
@@ -47,7 +48,7 @@ import {
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -593,7 +594,7 @@ function acmeKeyArgs(keyType) {
       return [];
   }
 }
-var DOMAIN_RE = /^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
+var DOMAIN_RE = /^(\*\.)?[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
 function assertValidDomain(domain) {
   if (!DOMAIN_RE.test(domain) || domain.length > 253) {
     throw new Error(`Invalid domain: ${domain}`);
@@ -601,7 +602,9 @@ function assertValidDomain(domain) {
 }
 function assertNoNginxInjection(value, what) {
   if (/[\s;{}#\\'"]/.test(value)) {
-    throw new Error(`Invalid ${what} (contains characters that could inject nginx config): ${value}`);
+    throw new Error(
+      `Invalid ${what} (contains characters that could inject nginx config): ${value}`
+    );
   }
 }
 function assertNoRuntimeVariable(value, what, allowCaptures = false) {
@@ -698,7 +701,9 @@ function certbotDiagnosis(output, domain) {
     diagnosis = `Couldn't start the certificate challenge listener for ${domain} on port ${ACME_HTTP01_PORT}: something on this server is already holding it. That port is used only while a certificate is being issued, so this is almost always a certificate run from an earlier attempt that hasn't exited \u2014 retry, and if it persists find the holder with \`ss -ltnp | grep ${ACME_HTTP01_PORT}\` and stop it. Nothing was requested from Let's Encrypt, so this is not a DNS or routing problem.`;
   } else if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
-  } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
+  } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(
+    text
+  )) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
   } else if (/\b52[56]\b|ssl handshake failed/i.test(text)) {
     diagnosis = `Cloudflare's proxy is answering the certificate challenge for ${domain} instead of forwarding it to this server: it redirects the request to HTTPS, then rejects the origin's TLS. Fix it one of three ways \u2014 set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record until it is, or upload a Cloudflare Origin CA certificate from the Domains tab and skip Let's Encrypt entirely.`;
@@ -721,6 +726,7 @@ var NginxProvider = class {
   acmeTosAgreed;
   certDir;
   executor;
+  paths;
   reloadCommand;
   pinPaths;
   containerEdge;
@@ -744,8 +750,9 @@ var NginxProvider = class {
     this.acmeTosAgreed = opts.acmeTosAgreed ?? true;
     this.certDir = opts.certDir ?? DEFAULT_CERT_DIR;
     this.executor = opts.executor ?? null;
+    this.paths = opts.paths;
     this.containerEdge = opts.containerEdge ?? false;
-    this.reloadCommand = buildReloadCommand(opts.paths, { containerEdge: this.containerEdge });
+    this.reloadCommand = buildReloadCommand(opts.paths);
     this.pinPaths = opts.pinPaths ?? false;
     this.challengeDir = opts.challengeDir ?? EDGE_CHALLENGE_DIR;
   }
@@ -1094,6 +1101,31 @@ eab-hmac-key = ${this.acmeEabHmacKey}
     }
     return path;
   }
+  /** Materialize generated DNS hooks on the same target where Certbot runs. */
+  async createEphemeralDnsHooks(opts) {
+    if (!opts?.dnsAuthHookScript) return null;
+    const dir = join(dirname(this.certDir), `.openship-dns-${randomBytes(12).toString("hex")}`);
+    const authPath = join(dir, "auth.sh");
+    const cleanupPath = join(dir, "cleanup.sh");
+    const recordPath = join(dir, "record-id.txt");
+    await this._mkdir(dir);
+    try {
+      await this._chmod(dir, 448);
+      await this._writeFile(authPath, opts.dnsAuthHookScript, 448);
+      if (opts.dnsCleanupHookScript) {
+        await this._writeFile(cleanupPath, opts.dnsCleanupHookScript, 448);
+      }
+    } catch (err) {
+      await this._rm(dir).catch(() => void 0);
+      throw err;
+    }
+    const recordEnv = `OPENSHIP_DNS_RECORD_FILE=${sq(recordPath)}`;
+    return {
+      dir,
+      authCommand: `${recordEnv} ${sq(authPath)}`,
+      cleanupCommand: opts.dnsCleanupHookScript ? `${recordEnv} ${sq(cleanupPath)}` : void 0
+    };
+  }
   async _captureFile(path) {
     if (!await this._exists(path)) {
       return { exists: false };
@@ -1347,7 +1379,9 @@ ${serveLocation}
    */
   async _lsSites() {
     if (!this.executor) return fsReaddir(this.sitesDir);
-    const out = await this.executor.exec(`ls -1 ${sq(this._commandSitesDir())} 2>/dev/null || true`);
+    const out = await this.executor.exec(
+      `ls -1 ${sq(this._commandSitesDir())} 2>/dev/null || true`
+    );
     return out.split("\n").map((l) => l.trim()).filter(Boolean);
   }
   /**
@@ -1410,8 +1444,11 @@ ${serveLocation}
    * from the old in-memory config (an inconsistent half-state that would silently
    * vanish on the next unrelated reload). The error is re-thrown for retry.
    */
-  async removeRoute(domain) {
+  async removeRoute(domain, opts) {
     assertValidDomain(domain);
+    if (opts?.signal?.aborted) {
+      throw new Error(`Route removal aborted before it started: ${domain}`);
+    }
     const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     const statePath = this.routeStatePath(slug);
@@ -1420,11 +1457,20 @@ ${serveLocation}
     await this._rm(configPath);
     await this._rm(statePath).catch(() => void 0);
     try {
-      await this.reload();
+      await this.reload({ allowStopped: true });
     } catch (err) {
-      await this._restoreFile(configPath, confSnapshot);
-      await this._restoreFile(statePath, stateSnapshot);
-      await this.reload().catch(() => void 0);
+      try {
+        if (!opts?.signal?.aborted) await this._restoreFile(configPath, confSnapshot);
+        if (!opts?.signal?.aborted) await this._restoreFile(statePath, stateSnapshot);
+        if (!opts?.signal?.aborted) {
+          await this.reload({ allowStopped: true }).catch(() => void 0);
+        }
+      } finally {
+        if (opts?.signal?.aborted) {
+          await this._rm(configPath).catch(() => void 0);
+          await this._rm(statePath).catch(() => void 0);
+        }
+      }
       throw err;
     }
     await this._rm(this.bootstrapCertDir(domain)).catch(() => void 0);
@@ -1531,31 +1577,47 @@ ${serveLocation}
     const emailArgs = validEmail ? ["--email", this.acmeEmail] : ["--register-unsafely-without-email"];
     let certonlyOut = "";
     const eabConfig = await this.createEphemeralEabConfig();
+    let generatedDnsHooks = null;
     try {
-      certonlyOut = await this._execCertbot([
-        ...eabConfig ? ["--config", eabConfig] : [],
+      generatedDnsHooks = await this.createEphemeralDnsHooks(opts);
+      const isDnsChallenge = opts?.challenge === "dns-01" || domain.startsWith("*.");
+      const challengeArgs = isDnsChallenge ? [
         "certonly",
-        "--standalone",
-        "--http-01-port",
-        String(ACME_HTTP01_PORT),
-        "--cert-name",
-        domain,
-        "-d",
-        domain,
-        ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
-        ...acmeKeyArgs(this.acmeKeyType),
-        ...emailArgs,
-        ...this.acmeTosAgreed ? ["--agree-tos"] : [],
-        "--non-interactive",
-        // Forced reissue: certbot would otherwise print "not due for renewal"
-        // (exit 0) when a lineage exists, leaving the stale cert in place.
-        ...opts?.force ? ["--force-renewal"] : []
-      ], opts?.onLog);
+        "--manual",
+        "--preferred-challenges",
+        "dns",
+        ...generatedDnsHooks?.authCommand || opts?.dnsAuthHook ? ["--manual-auth-hook", generatedDnsHooks?.authCommand ?? opts.dnsAuthHook] : [],
+        ...generatedDnsHooks?.cleanupCommand || opts?.dnsCleanupHook ? [
+          "--manual-cleanup-hook",
+          generatedDnsHooks?.cleanupCommand ?? opts.dnsCleanupHook
+        ] : []
+      ] : ["certonly", "--standalone", "--http-01-port", String(ACME_HTTP01_PORT)];
+      certonlyOut = await this._execCertbot(
+        [
+          ...eabConfig ? ["--config", eabConfig] : [],
+          ...challengeArgs,
+          "--cert-name",
+          domain,
+          "-d",
+          domain,
+          ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
+          ...acmeKeyArgs(this.acmeKeyType),
+          ...emailArgs,
+          ...this.acmeTosAgreed ? ["--agree-tos"] : [],
+          "--non-interactive",
+          // Forced reissue: certbot would otherwise print "not due for renewal"
+          // (exit 0) when a lineage exists, leaving the stale cert in place.
+          ...opts?.force ? ["--force-renewal"] : []
+        ],
+        opts?.onLog
+      );
     } catch (err) {
       const raw = this.redactAcmeSecrets(safeErrorMessage(err));
       let summary = summarizeCertbotFailure(raw, domain);
       if (isAcmePortBindFailure(raw) && this.executor) {
-        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(() => null);
+        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(
+          () => null
+        );
         if (occupant) {
           summary += ` Currently held by ${occupant.command}` + (occupant.pid !== null ? ` (pid ${occupant.pid})` : "") + (occupant.systemdUnit ? ` via ${occupant.systemdUnit}` : "") + `.`;
         }
@@ -1563,6 +1625,7 @@ ${serveLocation}
       throw new Error(summary);
     } finally {
       if (eabConfig) await this._rm(dirname(eabConfig)).catch(() => void 0);
+      if (generatedDnsHooks) await this._rm(generatedDnsHooks.dir).catch(() => void 0);
     }
     const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
@@ -1630,24 +1693,24 @@ ${tail}` : "")
   /**
    * Renew a TLS certificate using certbot.
    */
-  async renewCert(domain) {
+  async renewCert(domain, opts) {
     assertValidDomain(domain);
+    if (opts?.challenge === "dns-01" || domain.startsWith("*.")) {
+      return this.provisionCert(domain, { ...opts, challenge: "dns-01", force: true });
+    }
     if (!await this.certsExist(domain)) {
-      return this.provisionCert(domain);
+      return this.provisionCert(domain, opts);
     }
     if (!await this.hasCertbotLineage(domain)) {
-      return this.provisionCert(domain, { force: true });
+      return this.provisionCert(domain, { ...opts, force: true });
     }
     if (!await this.lineageServerMatches(domain)) {
-      return this.provisionCert(domain, { force: true });
+      return this.provisionCert(domain, { ...opts, force: true });
     }
-    await this._execCertbot([
-      "renew",
-      "--cert-name",
-      domain,
-      ...acmeKeyArgs(this.acmeKeyType),
-      "--non-interactive"
-    ]);
+    await this._execCertbot(
+      ["renew", "--cert-name", domain, ...acmeKeyArgs(this.acmeKeyType), "--non-interactive"],
+      opts?.onLog
+    );
     await this.reload();
     return this.readCertInfo(domain);
   }
@@ -1805,23 +1868,42 @@ ${tail}` : "")
    * config may move). Re-detecting on every reload keeps the provider
    * in sync without requiring an API restart.
    */
-  async reload() {
+  async reload(opts = {}) {
     if (this.executor) {
       if (!this.pinPaths) {
         try {
           const freshPaths = await detectOpenRestyPaths(this.executor);
+          this.paths = freshPaths;
           this.sitesDir = freshPaths.sitesDir;
           this.nginxVersion = freshPaths.nginxVersion ?? this.nginxVersion;
-          this.reloadCommand = buildReloadCommand(freshPaths, {
-            containerEdge: this.containerEdge
-          });
+          this.reloadCommand = buildReloadCommand(freshPaths);
         } catch {
         }
       }
-      await this.executor.exec(this.reloadCommand);
+      if (this.containerEdge) {
+        await this.executor.exec(this.reloadCommand, { timeout: 15e3 });
+      } else {
+        await reloadBareOpenResty(this.executor, this.paths, {
+          allowStopped: opts.allowStopped ?? false
+        });
+      }
       return;
     }
-    await execFileAsync("sh", ["-lc", this.reloadCommand]);
+    if (this.containerEdge) {
+      await execFileAsync("sh", ["-lc", this.reloadCommand], { timeout: 15e3 });
+      return;
+    }
+    const localExecutor = {
+      exec: async (command, execOpts) => {
+        const { stdout } = await execFileAsync("sh", ["-lc", command], {
+          timeout: execOpts?.timeout
+        });
+        return String(stdout);
+      }
+    };
+    await reloadBareOpenResty(localExecutor, this.paths, {
+      allowStopped: opts.allowStopped ?? false
+    });
   }
   async certsExist(domain) {
     const certPath = join(this.certDir, domain, "fullchain.pem");
@@ -2003,7 +2085,9 @@ ${geoEntries.join("\n")}
     if (!foundDesiredInclude) {
       const httpIndex = nextLines.findIndex((line) => /^\s*http\s*\{\s*$/.test(line));
       if (httpIndex === -1) {
-        throw new Error(`Failed to ensure rate-limit include: ${confPath} is missing an http block`);
+        throw new Error(
+          `Failed to ensure rate-limit include: ${confPath} is missing an http block`
+        );
       }
       const indent = nextLines[httpIndex].match(/^\s*/)?.[0] ?? "";
       nextLines.splice(httpIndex + 1, 0, `${indent}    ${desiredIncludeLine}`);