ysk-server-core 1.0.0 → 1.1.9

package/dist/hosting/nginx-sites-list.js

@@ -3,6 +3,18 @@
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { listResources } from './managed-resources.js';
+function serverNameFromConf(confPath) {
+    if (!confPath || !existsSync(confPath))
+        return '';
+    try {
+        const body = readFileSync(confPath, 'utf8');
+        const m = body.match(/^\s*server_name\s+([^;]+);/m);
+        return (m?.[1] ?? '').trim();
+    }
+    catch {
+        return '';
+    }
+}
 function kindFromRuntime(runtime) {
     const r = String(runtime ?? '').toLowerCase();
     if (r === 'static')
@@ -11,6 +23,26 @@ function kindFromRuntime(runtime) {
         return 'php';
     return 'proxy';
 }
+function certDomainSet(db) {
+    const set = new Set();
+    const certs = db.snapshot.certificates ?? [];
+    for (const c of certs) {
+        const d = String(c.domain ?? '').trim().toLowerCase();
+        if (d)
+            set.add(d);
+    }
+    return set;
+}
+function confMentionsSsl(confPath) {
+    if (!confPath || !existsSync(confPath))
+        return false;
+    try {
+        return /ssl_certificate\s+\S+/.test(readFileSync(confPath, 'utf8'));
+    }
+    catch {
+        return false;
+    }
+}
 function projectTarget(p) {
     const kind = kindFromRuntime(p.runtime);
     if (kind === 'static' || kind === 'php') {
@@ -26,6 +58,7 @@ function projectTarget(p) {
  */
 export function listMergedNginxSites(input) {
     const rows = [];
+    const certs = certDomainSet(input.db);
     for (const p of input.projects) {
         const domain = String(p.domain ?? '').trim();
         if (!domain && !String(p.nginxConfigPath ?? p.nginx_config_path ?? '').trim()) {
@@ -35,15 +68,16 @@ export function listMergedNginxSites(input) {
         if (!id)
             continue;
         const confPath = (p.nginxConfigPath ?? p.nginx_config_path);
+        const hasCert = Boolean(domain && certs.has(domain.toLowerCase()));
         rows.push({
             id: `project:${id}`,
             source: 'project',
             projectId: id,
             projectName: String(p.name ?? id),
-            serverName: domain || '—',
+            serverName: domain || serverNameFromConf(confPath) || '—',
             kind: kindFromRuntime(p.runtime),
             target: projectTarget(p),
-            ssl: Boolean(p.ssl ?? p.force_https ?? p.forceHttps),
+            ssl: Boolean(p.ssl ?? p.force_https ?? p.forceHttps) || hasCert || confMentionsSsl(confPath),
             forceHttps: Boolean(p.force_https ?? p.forceHttps),
             hsts: Boolean(p.hsts),
             confPath: confPath ?? null,
@@ -63,7 +97,9 @@ export function listMergedNginxSites(input) {
             serverName: String(s.serverName ?? s.server_name ?? '—'),
             kind: kind === 'static' || kind === 'php' ? kind : 'proxy',
             target,
-            ssl: Boolean(s.ssl),
+            ssl: Boolean(s.ssl) ||
+                certs.has(String(s.serverName ?? s.server_name ?? '').trim().toLowerCase()) ||
+                confMentionsSsl(s.confPath ?? null),
             forceHttps: Boolean(s.forceHttps ?? s.force_https),
             hsts: Boolean(s.hsts),
             confPath: s.confPath ?? null,

package/dist/hosting/nginx-sites-list.js.map

@@ -1 +1 @@
-{"version":3,"file":"nginx-sites-list.js","sourceRoot":"","sources":["../../src/hosting/nginx-sites-list.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAuBvD,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,CAA0B;IAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,IAAI,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,MAAM,IAAI,GAAmB,EAAE,CAAC;IAEhC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,iBAAiB,CAAuB,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,WAAW,EAAE,EAAE;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACjC,UAAU,EAAE,MAAM,IAAI,GAAG;YACzB,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,OAAiB,CAAC;YAC1C,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YACxB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;YACpD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,QAAQ,IAAI,IAAI;YAC1B,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YAC5C,OAAO,EAAG,CAAC,CAAC,OAAkB,IAAI,IAAI;YACtC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAkB,CAAC;QACxD,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC;YACxD,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YAC1D,MAAM;YACN,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC;YAClD,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAG,CAAC,CAAC,QAAmB,IAAI,IAAI;YACxC,YAAY,EAAG,CAAC,CAAC,YAAuB,IAAI,IAAI;SACjD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAC7E,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAmC;IACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"nginx-sites-list.js","sourceRoot":"","sources":["../../src/hosting/nginx-sites-list.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAuBvD,SAAS,kBAAkB,CAAC,QAAwB;IAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,EAAa;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,KAAK,GAAI,EAAE,CAAC,QAA8D,CAAC,YAAY,IAAI,EAAE,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,QAAmC;IAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAA0B;IAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,IAAI,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEtC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,iBAAiB,CAAuB,CAAC;QAClF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,WAAW,EAAE,EAAE;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACjC,UAAU,EAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,GAAG;YACzD,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,OAAiB,CAAC;YAC1C,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YACxB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC;YAC5F,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,QAAQ,IAAI,IAAI;YAC1B,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YAC5C,OAAO,EAAG,CAAC,CAAC,OAAkB,IAAI,IAAI;YACtC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAkB,CAAC;QACxD,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC;YACxD,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YAC1D,MAAM;YACN,GAAG,EACD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;gBACd,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC3E,eAAe,CAAE,CAAC,CAAC,QAAmB,IAAI,IAAI,CAAC;YACjD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC;YAClD,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAG,CAAC,CAAC,QAAmB,IAAI,IAAI;YACxC,YAAY,EAAG,CAAC,CAAC,YAAuB,IAAI,IAAI;SACjD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAC7E,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAmC;IACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/hosting/nginx-ssl.d.ts

@@ -10,6 +10,9 @@ export type NginxRealIpOpts = {
     realIpProvider?: RealIpProviderId | 'inherit';
     realIpHost?: RealIpHostConfig;
 };
+/** One nginx server_name token (hostname, wildcard, or `_`). */
+export declare function sanitizeNginxServerNameToken(raw: string): string | null;
+export declare function sanitizeNginxServerNameList(raw: string): string;
 /** Build space-separated server_name from primary + aliases. */
 export declare function buildServerNameList(primary?: string, aliases?: string[]): string;
 /** listen directives with optional bind IP (dual-stack when unbound). */
@@ -20,6 +23,7 @@ export declare function nginxListenLines(opts: {
 /**
  * Render an Nginx server block for reverse proxy.
  */
+export declare function requireNginxServerName(raw: string): string;
 export declare function renderNginxProxy(config: NginxProxyConfig): string;
 export declare function renderNginxStatic(opts: {
     serverName: string;

package/dist/hosting/nginx-ssl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nginx-ssl.d.ts","sourceRoot":"","sources":["../../src/hosting/nginx-ssl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG;IAC5B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC9C,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B,CAAC;AAUF,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAMhF;AAuBD,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAsBT;AAYD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CA8EjE;AA2CD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IACJ,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,GAClB,MAAM,CA2DR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IACJ,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,eAAe,GAClB,MAAM,CA4BR;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,IAAI,EAAE,OAAO,qBAAqB,EAAE,YAAY,CAAC;CAClD,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA2B/D;AAED,+CAA+C;AAC/C,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO/D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkC1F"}
+{"version":3,"file":"nginx-ssl.d.ts","sourceRoot":"","sources":["../../src/hosting/nginx-ssl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG;IAC5B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC9C,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B,CAAC;AAUF,gEAAgE;AAChE,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAavE;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAMhF;AAuBD,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAsBT;AAaD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAY1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CA+EjE;AA4CD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IACJ,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,GAClB,MAAM,CA4DR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IACJ,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,eAAe,GAClB,MAAM,CA4BR;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,IAAI,EAAE,OAAO,qBAAqB,EAAE,YAAY,CAAC;CAClD,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA2B/D;AAED,+CAA+C;AAC/C,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkC1F"}

package/dist/hosting/nginx-ssl.js

@@ -10,11 +10,38 @@ function realIpSnippet(opts) {
         cloudflareRealIp: opts.cloudflareRealIp,
     });
 }
+/** One nginx server_name token (hostname, wildcard, or `_`). */
+export function sanitizeNginxServerNameToken(raw) {
+    const s = String(raw ?? '').trim().toLowerCase();
+    if (!s || s.length > 253)
+        return null;
+    if (/[;{}$'"\\]/.test(s))
+        return null;
+    if (s === '_' || s === 'localhost')
+        return s;
+    const body = s.startsWith('*.') ? s.slice(2) : s;
+    if (/^(?:\d{1,3}\.){3}\d{1,3}$/.test(body))
+        return s;
+    // Require a dot so directive words (return, include, …) cannot be tokens
+    if (!body.includes('.'))
+        return null;
+    if (/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(body)) {
+        return s;
+    }
+    return null;
+}
+export function sanitizeNginxServerNameList(raw) {
+    const kept = String(raw ?? '')
+        .split(/\s+/)
+        .map(sanitizeNginxServerNameToken)
+        .filter((x) => Boolean(x));
+    return [...new Set(kept)].join(' ') || 'localhost';
+}
 /** Build space-separated server_name from primary + aliases. */
 export function buildServerNameList(primary, aliases) {
     const names = [primary, ...(aliases ?? [])]
-        .map((s) => (s ?? '').trim().toLowerCase())
-        .filter(Boolean);
+        .map((s) => sanitizeNginxServerNameToken((s ?? '').trim().toLowerCase()))
+        .filter((x) => Boolean(x));
     const uniq = [...new Set(names)];
     return uniq.join(' ') || 'localhost';
 }
@@ -59,9 +86,10 @@ export function nginxListenLines(opts) {
 }
 function httpRedirectBlock(serverName, bindIp) {
     const listen = nginxListenLines({ ssl: false, bindIp });
+    const name = sanitizeNginxServerNameList(serverName);
     return `server {
   ${listen}
-  server_name ${serverName};
+  server_name ${name};
   return 301 https://$host$request_uri;
 }
 `;
@@ -69,8 +97,22 @@ function httpRedirectBlock(serverName, bindIp) {
 /**
  * Render an Nginx server block for reverse proxy.
  */
+export function requireNginxServerName(raw) {
+    const kept = String(raw ?? '')
+        .split(/\s+/)
+        .map(sanitizeNginxServerNameToken)
+        .filter((x) => Boolean(x));
+    const name = [...new Set(kept)].join(' ');
+    if (!name) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1388'), {
+            httpStatus: 400,
+        });
+    }
+    return name;
+}
 export function renderNginxProxy(config) {
-    if (!config.serverName || !config.upstream) {
+    config = { ...config, serverName: requireNginxServerName(config.serverName) };
+    if (!config.upstream) {
         throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1388'), {
             httpStatus: 400,
         });
@@ -156,24 +198,26 @@ function authBasicBlock(opts) {
 `;
 }
 function siteRedirectOnly(opts) {
+    const serverName = sanitizeNginxServerNameList(opts.serverName);
     const target = opts.siteRedirectUrl.replace(/"/g, '');
     const listen = nginxListenLines({ ssl: opts.ssl, bindIp: opts.bindIp });
     const sslBlock = sslLines({
         ssl: opts.ssl,
         sslCertificate: opts.sslCertificate,
         sslCertificateKey: opts.sslCertificateKey,
-        serverName: opts.serverName,
+        serverName,
         hsts: opts.hsts,
     });
     return `server {
   ${listen}
-  server_name ${opts.serverName};
+  server_name ${serverName};
   ${sslBlock}
   return 301 ${target}$request_uri;
 }
 `;
 }
 export function renderNginxStatic(opts) {
+    opts = { ...opts, serverName: sanitizeNginxServerNameList(opts.serverName) };
     if (!opts.serverName || !opts.docRoot) {
         throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1389'), {
             httpStatus: 400,
@@ -294,9 +338,10 @@ export async function purgeNginxCache(input) {
 }
 /** Suspended site: refuse traffic with 503. */
 export function renderNginxSuspended(serverName) {
+    const name = sanitizeNginxServerNameList(serverName);
     return `server {
   listen 80;
-  server_name ${serverName};
+  server_name ${name};
   return 503;
 }
 `;

package/dist/hosting/nginx-ssl.js.map

@@ -1 +1 @@
-{"version":3,"file":"nginx-ssl.js","sourceRoot":"","sources":["../../src/hosting/nginx-ssl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,sBAAsB,GAGvB,MAAM,oBAAoB,CAAC;AAU5B,SAAS,aAAa,CAAC,IAAqB;IAC1C,OAAO,sBAAsB,CAAC;QAC5B,QAAQ,EAAE,IAAI,CAAC,cAAc;QAC7B,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,OAAkB;IACtE,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,IAMjB;IACC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,IAAI,yBAAyB,OAAO,gBAAgB,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,yBAAyB,OAAO,cAAc,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;QACpB,CAAC,CAAC,wFAAwF;QAC1F,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;oBACW,IAAI;wBACA,GAAG;kCACO,IAAI;CACrC,CAAC,IAAI,EAAE,CAAC;AACT,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,IAGhC;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,EAAE,EAAE,CAAC;QACP,gDAAgD;QAChD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,UAAU,MAAM,4BAA4B,MAAM,KAAK,CAAC;QACjE,CAAC;QACD,OAAO,UAAU,MAAM,KAAK,CAAC;IAC/B,CAAC;IACD,4CAA4C;IAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO;YACL,uBAAuB;YACvB,4BAA4B;YAC5B,YAAY;YACZ,iBAAiB;SAClB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,MAAe;IAC5D,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO;IACL,MAAM;gBACM,UAAU;;;CAGzB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAG,MAA6C,CAAC,cAAc;QAC7E,UAAU,EAAG,MAA6C,CAAC,UAAU;KACtE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IACtD,SAAS;gBACG,MAAM,CAAC,UAAU;IAC7B,QAAQ;IACR,MAAM;IACN,IAAI;;;iBAGS,MAAM,CAAC,QAAQ;;;;;;;;;;CAU/B,CAAC;IACA,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,OAAO;IACL,MAAM;gBACM,MAAM,CAAC,UAAU;IAC7B,QAAQ;IACR,MAAM;IACN,IAAI;;;iBAGS,MAAM,CAAC,QAAQ;;;;;;;;;;CAU/B,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,IAGvB;IACC,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;gBACO,IAAI,CAAC,cAAc,IAAI,YAAY;yBAC1B,IAAI,CAAC,iBAAiB;CAC9C,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAQzB;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,OAAO;IACL,MAAM;gBACM,IAAI,CAAC,UAAU;IAC3B,QAAQ;eACG,MAAM;;CAEpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAemB;IAEnB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;IAE9C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;IAC/B,MAAM;gBACM,IAAI,CAAC,UAAU;SACtB,IAAI,CAAC,OAAO;;IAEjB,QAAQ;IACR,MAAM;IACN,IAAI;;;;;;;;;;;MAWF,UAAU,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,cAAc;;;;CAIxF,CAAC;IAEA,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAkBmB;IAEnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClC,oEAAoE;QACpE,UAAU,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC;IAElH,8DAA8D;IAC9D,OAAO,gBAAgB,CAAC;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ;QACR,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;KACU,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAErC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACnC;QACE,MAAM;QACN,IAAI;QACJ,wJAAwJ;KACzJ,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,OAAO;QACL,EAAE;QACF,KAAK,EAAE;YACL,EAAE;gBACA,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvD,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC;SAClE;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO;;gBAEO,UAAU;;;CAGzB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC;IAC3D,yFAAyF;IACzF,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,wDAAwD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,gCAAgC;QAC/H,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,KAAK,2CAA2C,CAAC;IACvG,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,wBAAwB,CAAC;QACxE,KAAK,EAAE,QAAQ;YACb,CAAC,CAAC;gBACE,EAAE,CAAC,kBAAkB,CAAC;gBACtB,EAAE,CAAC,kBAAkB,CAAC;gBACtB,EAAE,CAAC,kBAAkB,CAAC;aACvB;YACH,CAAC,CAAC;gBACE,qDAAqD;gBACrD,2BAA2B;aAC5B;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"nginx-ssl.js","sourceRoot":"","sources":["../../src/hosting/nginx-ssl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,sBAAsB,GAGvB,MAAM,oBAAoB,CAAC;AAU5B,SAAS,aAAa,CAAC,IAAqB;IAC1C,OAAO,sBAAsB,CAAC;QAC5B,QAAQ,EAAE,IAAI,CAAC,cAAc;QAC7B,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACrD,yEAAyE;IACzE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;SAC3B,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,4BAA4B,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;AACrD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,OAAkB;IACtE,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;SACxE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,IAMjB;IACC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,IAAI,yBAAyB,OAAO,gBAAgB,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,yBAAyB,OAAO,cAAc,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;QACpB,CAAC,CAAC,wFAAwF;QAC1F,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;oBACW,IAAI;wBACA,GAAG;kCACO,IAAI;CACrC,CAAC,IAAI,EAAE,CAAC;AACT,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,IAGhC;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,EAAE,EAAE,CAAC;QACP,gDAAgD;QAChD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,UAAU,MAAM,4BAA4B,MAAM,KAAK,CAAC;QACjE,CAAC;QACD,OAAO,UAAU,MAAM,KAAK,CAAC;IAC/B,CAAC;IACD,4CAA4C;IAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO;YACL,uBAAuB;YACvB,4BAA4B;YAC5B,YAAY;YACZ,iBAAiB;SAClB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,MAAe;IAC5D,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO;IACL,MAAM;gBACM,IAAI;;;CAGnB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;SAC3B,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,4BAA4B,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAG,MAA6C,CAAC,cAAc;QAC7E,UAAU,EAAG,MAA6C,CAAC,UAAU;KACtE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IACtD,SAAS;gBACG,MAAM,CAAC,UAAU;IAC7B,QAAQ;IACR,MAAM;IACN,IAAI;;;iBAGS,MAAM,CAAC,QAAQ;;;;;;;;;;CAU/B,CAAC;IACA,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,OAAO;IACL,MAAM;gBACM,MAAM,CAAC,UAAU;IAC7B,QAAQ;IACR,MAAM;IACN,IAAI;;;iBAGS,MAAM,CAAC,QAAQ;;;;;;;;;;CAU/B,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,IAGvB;IACC,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;gBACO,IAAI,CAAC,cAAc,IAAI,YAAY;yBAC1B,IAAI,CAAC,iBAAiB;CAC9C,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAQzB;IACC,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU;QACV,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,OAAO;IACL,MAAM;gBACM,UAAU;IACtB,QAAQ;eACG,MAAM;;CAEpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAemB;IAEnB,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;IAE9C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;IAC/B,MAAM;gBACM,IAAI,CAAC,UAAU;SACtB,IAAI,CAAC,OAAO;;IAEjB,QAAQ;IACR,MAAM;IACN,IAAI;;;;;;;;;;;MAWF,UAAU,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,cAAc;;;;CAIxF,CAAC;IAEA,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAkBmB;IAEnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClC,oEAAoE;QACpE,UAAU,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC;IAElH,8DAA8D;IAC9D,OAAO,gBAAgB,CAAC;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ;QACR,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;KACU,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAErC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACnC;QACE,MAAM;QACN,IAAI;QACJ,wJAAwJ;KACzJ,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,OAAO;QACL,EAAE;QACF,KAAK,EAAE;YACL,EAAE;gBACA,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvD,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC;SAClE;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,MAAM,IAAI,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO;;gBAEO,IAAI;;;CAGnB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC;IAC3D,yFAAyF;IACzF,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,wDAAwD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,gCAAgC;QAC/H,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,KAAK,2CAA2C,CAAC;IACvG,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,wBAAwB,CAAC;QACxE,KAAK,EAAE,QAAQ;YACb,CAAC,CAAC;gBACE,EAAE,CAAC,kBAAkB,CAAC;gBACtB,EAAE,CAAC,kBAAkB,CAAC;gBACtB,EAAE,CAAC,kBAAkB,CAAC;aACvB;YACH,CAAC,CAAC;gBACE,qDAAqD;gBACrD,2BAA2B;aAC5B;KACN,CAAC;AACJ,CAAC"}

package/dist/hosting/nginx-sync.d.ts

@@ -18,12 +18,46 @@ export interface NginxSyncResult {
 /**
  * Ensure managed nginx conf dir exists; optionally copy to system sites and nginx -t.
  */
+/** Managed `ysks_xxx.conf` or system `ysk-ysks_xxx.conf`. */
+export declare function isProjectNginxConfName(name: string): boolean;
+export declare function linuxUserFromNginxConfName(name: string): string;
+/** Remove project vhosts whose linux user is no longer in the store. */
+export declare function pruneOrphanProjectNginxConfs(opts: {
+    managedDir: string;
+    systemDir?: string | null;
+    keepLinuxUsers: string[];
+}): string[];
+export declare const YSK_DEFAULT_NGINX_BASENAME = "000-default.conf";
+export type YskDefaultSslMode = 'reject' | 'selfsigned';
+/** Catch-all so unknown Host / SNI does not fall into another site's vhost. */
+export declare function renderYskDefaultNginxConf(opts?: {
+    sslMode?: YskDefaultSslMode;
+    sslCertificate?: string;
+    sslCertificateKey?: string;
+}): string;
+export declare function ensureYskDefaultNginxConf(managedDir: string, opts?: {
+    sslMode?: YskDefaultSslMode;
+    sslCertificate?: string;
+    sslCertificateKey?: string;
+}): string;
+/** Remove default_server from listen lines (keep our catch-all file). */
+export declare function stripListenDefaultServer(body: string): string;
+export declare function isYskManagedSystemConfName(name: string): boolean;
+/** System copies whose managed source is gone (all ysk-*.conf, not only ysks_*). */
+export declare function pruneStaleYskSystemNginxConfs(systemDir: string, managedBasenames: string[]): string[];
+export declare function publicFilesConfBasename(serverName: string): string;
+export declare function pruneStalePublicFilesNginxConfs(managedDir: string, keepBasename?: string | null): string[];
+export declare function keepPublicFilesBasenameFromMeta(dataDir: string): string | undefined;
 export declare function syncNginxConfigs(opts: {
     dataDir: string;
     /** e.g. /etc/nginx/conf.d — only used when executeEnabled + writable */
     systemConfDir?: string;
     host: HostExecutor;
     dryRun?: boolean;
+    /** When set, drop ysks_* vhosts whose linux user is not live */
+    keepLinuxUsers?: string[];
+    /** Keep this public-files-*.conf; drop other public-files leftovers */
+    keepPublicFilesConf?: string;
 }): Promise<NginxSyncResult>;
 /**
  * Write a single server block into managed conf.d.

package/dist/hosting/nginx-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nginx-sync.d.ts","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iEAAiE;IACjE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwG3B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAchG;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS3G"}
+{"version":3,"file":"nginx-sync.d.ts","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iEAAiE;IACjE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,6DAA6D;AAC7D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wEAAwE;AACxE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,GAAG,MAAM,EAAE,CAqBX;AAED,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAExD,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE;IAC/C,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,MAAM,CA8BT;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IACL,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GACA,MAAM,CAKR;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,oFAAoF;AACpF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,EAAE,CAkBV;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAC3B,MAAM,EAAE,CAeV;AA4ED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnF;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,eAAe,CAAC,CAqJ3B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAchG;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS3G"}

package/dist/hosting/nginx-sync.js

@@ -8,9 +8,236 @@ import { injectDefenseLimitsIntoConf } from './defense/nginx-limits.js';
 /**
  * Ensure managed nginx conf dir exists; optionally copy to system sites and nginx -t.
  */
+/** Managed `ysks_xxx.conf` or system `ysk-ysks_xxx.conf`. */
+export function isProjectNginxConfName(name) {
+    return /^(ysk-)?ysks_[a-z0-9]+\.conf$/i.test(name);
+}
+export function linuxUserFromNginxConfName(name) {
+    return name.replace(/^ysk-/i, '').replace(/\.conf$/i, '');
+}
+/** Remove project vhosts whose linux user is no longer in the store. */
+export function pruneOrphanProjectNginxConfs(opts) {
+    const keep = new Set(opts.keepLinuxUsers.map((u) => u.trim().toLowerCase()).filter(Boolean));
+    const removed = [];
+    const sweep = (dir) => {
+        if (!dir || !existsSync(dir))
+            return;
+        for (const f of readdirSync(dir)) {
+            if (!isProjectNginxConfName(f))
+                continue;
+            const user = linuxUserFromNginxConfName(f).toLowerCase();
+            if (keep.has(user))
+                continue;
+            const path = join(dir, f);
+            try {
+                unlinkSync(path);
+                removed.push(path);
+            }
+            catch {
+                /* leave in place */
+            }
+        }
+    };
+    sweep(opts.managedDir);
+    sweep(opts.systemDir ?? undefined);
+    return removed;
+}
+export const YSK_DEFAULT_NGINX_BASENAME = '000-default.conf';
+/** Catch-all so unknown Host / SNI does not fall into another site's vhost. */
+export function renderYskDefaultNginxConf(opts) {
+    const sslMode = opts?.sslMode ?? 'reject';
+    const http = `server {
+  listen 80 default_server;
+  listen [::]:80 default_server;
+  server_name _;
+  return 444;
+}`;
+    if (sslMode === 'selfsigned' && opts?.sslCertificate && opts.sslCertificateKey) {
+        return `# YSK catch-all — unknown Host / SNI must not serve another site
+${http}
+server {
+  listen 443 ssl default_server;
+  listen [::]:443 ssl default_server;
+  server_name _;
+  ssl_certificate ${opts.sslCertificate};
+  ssl_certificate_key ${opts.sslCertificateKey};
+  return 444;
+}
+`;
+    }
+    return `# YSK catch-all — unknown Host / SNI must not serve another site
+${http}
+server {
+  listen 443 ssl default_server;
+  listen [::]:443 ssl default_server;
+  server_name _;
+  ssl_reject_handshake on;
+}
+`;
+}
+export function ensureYskDefaultNginxConf(managedDir, opts) {
+    mkdirSync(managedDir, { recursive: true });
+    const path = join(managedDir, YSK_DEFAULT_NGINX_BASENAME);
+    writeFileSync(path, renderYskDefaultNginxConf(opts), 'utf8');
+    return path;
+}
+/** Remove default_server from listen lines (keep our catch-all file). */
+export function stripListenDefaultServer(body) {
+    return body.replace(/^(\s*listen\s+[^;]*?)\s+default_server(\s+[^;]*)?;/gm, (_, pre, rest) => `${pre}${rest ?? ''};`);
+}
+export function isYskManagedSystemConfName(name) {
+    return /^ysk-.+\.conf$/i.test(name);
+}
+/** System copies whose managed source is gone (all ysk-*.conf, not only ysks_*). */
+export function pruneStaleYskSystemNginxConfs(systemDir, managedBasenames) {
+    if (!existsSync(systemDir))
+        return [];
+    const keep = new Set(managedBasenames.map((f) => (f.startsWith('ysk-') ? f : `ysk-${f}`)));
+    const removed = [];
+    for (const f of readdirSync(systemDir)) {
+        if (!isYskManagedSystemConfName(f))
+            continue;
+        if (keep.has(f))
+            continue;
+        const path = join(systemDir, f);
+        try {
+            unlinkSync(path);
+            removed.push(path);
+        }
+        catch {
+            /* leave */
+        }
+    }
+    return removed;
+}
+export function publicFilesConfBasename(serverName) {
+    return `public-files-${serverName.trim().toLowerCase().replace(/\./g, '-')}.conf`;
+}
+export function pruneStalePublicFilesNginxConfs(managedDir, keepBasename) {
+    if (!existsSync(managedDir) || !keepBasename)
+        return [];
+    const removed = [];
+    for (const f of readdirSync(managedDir)) {
+        if (!f.startsWith('public-files-') || !f.endsWith('.conf'))
+            continue;
+        if (f === keepBasename)
+            continue;
+        const path = join(managedDir, f);
+        try {
+            unlinkSync(path);
+            removed.push(path);
+        }
+        catch {
+            /* leave */
+        }
+    }
+    return removed;
+}
+const YSK_DEFAULT_SYSTEM_NAME = `ysk-${YSK_DEFAULT_NGINX_BASENAME}`;
+function stripForeignDefaultServer(dir, notes) {
+    if (!existsSync(dir))
+        return;
+    for (const f of readdirSync(dir)) {
+        if (!f.endsWith('.conf'))
+            continue;
+        if (f === YSK_DEFAULT_NGINX_BASENAME || f === YSK_DEFAULT_SYSTEM_NAME)
+            continue;
+        const path = join(dir, f);
+        try {
+            const prev = readFileSync(path, 'utf8');
+            if (!/\bdefault_server\b/.test(prev))
+                continue;
+            const next = stripListenDefaultServer(prev);
+            if (next !== prev) {
+                writeFileSync(path, next, 'utf8');
+                notes.push(`stripped default_server from ${path}`);
+            }
+        }
+        catch {
+            /* leave */
+        }
+    }
+}
+async function disableDistroNginxDefault(host, notes) {
+    const targets = [
+        '/etc/nginx/sites-enabled/default',
+        '/etc/nginx/sites-enabled/default-ssl',
+    ];
+    for (const p of targets) {
+        if (!host.pathExists(p))
+            continue;
+        try {
+            unlinkSync(p);
+            notes.push(`disabled distro nginx site ${p}`);
+        }
+        catch {
+            const r = await host.runCommand(['rm', '-f', p], { timeoutMs: 5_000 });
+            if (r.exitCode === 0)
+                notes.push(`disabled distro nginx site ${p}`);
+        }
+    }
+}
+async function ensureDefaultSelfSigned(host, dataDir) {
+    const dir = join(dataDir, 'nginx', 'default-tls');
+    const cert = join(dir, 'fullchain.pem');
+    const key = join(dir, 'privkey.pem');
+    if (existsSync(cert) && existsSync(key))
+        return { cert, key };
+    mkdirSync(dir, { recursive: true });
+    const r = await host.runCommand([
+        'openssl',
+        'req',
+        '-x509',
+        '-newkey',
+        'rsa:2048',
+        '-keyout',
+        key,
+        '-out',
+        cert,
+        '-days',
+        '3650',
+        '-nodes',
+        '-subj',
+        '/CN=_',
+    ], { timeoutMs: 20_000 });
+    if (r.exitCode !== 0 || !existsSync(cert) || !existsSync(key))
+        return null;
+    return { cert, key };
+}
+export function keepPublicFilesBasenameFromMeta(dataDir) {
+    const metaPath = join(dataDir, 'files', 'public-files-meta.json');
+    if (!existsSync(metaPath))
+        return undefined;
+    try {
+        const meta = JSON.parse(readFileSync(metaPath, 'utf8'));
+        const sn = String(meta.serverName ?? '').trim();
+        return sn ? publicFilesConfBasename(sn) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function syncNginxConfigs(opts) {
     const sourceDir = join(opts.dataDir, 'nginx', 'conf.d');
     mkdirSync(sourceDir, { recursive: true });
+    const pruneNotes = [];
+    if (!opts.dryRun) {
+        const keepPf = opts.keepPublicFilesConf ?? keepPublicFilesBasenameFromMeta(opts.dataDir);
+        for (const p of pruneStalePublicFilesNginxConfs(sourceDir, keepPf)) {
+            pruneNotes.push(tl('notes.nginx.removedOrphan', { path: p }));
+        }
+    }
+    ensureYskDefaultNginxConf(sourceDir);
+    if (opts.keepLinuxUsers && !opts.dryRun) {
+        const removed = pruneOrphanProjectNginxConfs({
+            managedDir: sourceDir,
+            systemDir: opts.systemConfDir,
+            keepLinuxUsers: opts.keepLinuxUsers,
+        });
+        for (const p of removed) {
+            pruneNotes.push(tl('notes.nginx.removedOrphan', { path: p }));
+        }
+    }
     // always write a managed main include snippet for documentation
     const managedMain = join(opts.dataDir, 'nginx', 'ysk-managed.conf');
     writeFileSync(managedMain, `# Generated by YSK Server — include from main nginx.conf:\n# include ${sourceDir}/*.conf;\n`, 'utf8');
@@ -23,6 +250,7 @@ export async function syncNginxConfigs(opts) {
     const notes = [
         tl('notes.nginx.managedDir', { path: sourceDir }),
         tl('notes.nginx.includeHint', { path: sourceDir }),
+        ...pruneNotes,
     ];
     const copied = [];
     const targetDir = opts.systemConfDir ?? null;
@@ -54,24 +282,20 @@ export async function syncNginxConfigs(opts) {
             copyFileSync(src, dest);
             copied.push(dest);
         }
-        // Drop orphan project vhosts left after delete/recreate (same server_name → 502)
         try {
-            const managedSet = new Set(files.map((f) => `ysk-${f}`));
-            for (const f of readdirSync(targetDir)) {
-                // Only project linux_user confs: ysk-ysks_xxxxxxxx.conf
-                if (!/^ysk-ysks_[a-z0-9]+\.conf$/i.test(f))
-                    continue;
-                if (managedSet.has(f))
-                    continue;
-                const orphan = join(targetDir, f);
-                unlinkSync(orphan);
-                notes.push(tl('notes.nginx.removedOrphan', { path: orphan }));
+            for (const p of pruneStaleYskSystemNginxConfs(targetDir, files)) {
+                notes.push(tl('notes.nginx.removedOrphan', { path: p }));
             }
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
             notes.push(tl('notes.nginx.orphanCleanupFailed', { detail: msg.slice(0, 120) }));
         }
+        await disableDistroNginxDefault(opts.host, notes);
+        stripForeignDefaultServer(targetDir, notes);
+        if (existsSync('/etc/nginx/sites-enabled')) {
+            stripForeignDefaultServer('/etc/nginx/sites-enabled', notes);
+        }
         notes.push(tl('notes.auto.t0427', { v0: (copied.length) }));
     }
     else if (targetDir) {
@@ -84,6 +308,29 @@ export async function syncNginxConfigs(opts) {
         const r = await opts.host.runCommand(['nginx', '-t'], { timeoutMs: 10_000 });
         tested = r.exitCode === 0;
         testOutput = `${r.stdout}\n${r.stderr}`.trim();
+        if (!tested &&
+            /ssl_reject_handshake|unknown directive/i.test(testOutput) &&
+            targetDir &&
+            opts.host.executeEnabled()) {
+            const tls = await ensureDefaultSelfSigned(opts.host, opts.dataDir);
+            if (tls) {
+                ensureYskDefaultNginxConf(sourceDir, {
+                    sslMode: 'selfsigned',
+                    sslCertificate: tls.cert,
+                    sslCertificateKey: tls.key,
+                });
+                try {
+                    copyFileSync(join(sourceDir, YSK_DEFAULT_NGINX_BASENAME), join(targetDir, YSK_DEFAULT_SYSTEM_NAME));
+                }
+                catch {
+                    /* */
+                }
+                const r2 = await opts.host.runCommand(['nginx', '-t'], { timeoutMs: 10_000 });
+                tested = r2.exitCode === 0;
+                testOutput = `${r2.stdout}\n${r2.stderr}`.trim();
+                notes.push('catch-all 443 fell back to a local self-signed cert (ssl_reject_handshake unavailable)');
+            }
+        }
         notes.push(tested ? tl('notes.nginx.configOk') : tl('notes.tpl.nginxConfigFailed', { detail: testOutput || tl('notes.tpl.unknownError') }));
     }
     else {