kevinveenbirkenbachandClaude Opus 5.5 47160d755e fix(tls): serve every vhost the certificate of its own domain ...

ssl_credentials.j2 resolved the certificate by application_id, so every vhost of an application got the lineage of its primary domain. echoserver serves webmail.infinito.nexus the CN=academy.infinito.nexus certificate that names mail.infinito.nexus but not webmail, and browsers refuse it with a hostname mismatch. The template and the letsencrypt existence check now resolve by the vhost's domain, so a secondary vhost points at its own live/<domain> link and a missing link triggers the issuance instead of a mismatch. Primary vhosts resolve to the same files as before in every TLS mode and flavor.

The LDAP stream passes its primary domain explicitly. Onion domains stay on the application lineage, and the app-scoped self-signed path always names the application leaf, because neither has a per-domain certificate.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-23 23:41:33 +02:00

..

action

perf(web-opt-rdr-domains): check every certificate in one task and write every file in one call

2026-10-23 16:35:45 +02:00

filter

feat(web-opt-rdr-domains): redirect a whole legacy zone with one wildcard source

2026-10-23 20:17:19 +02:00

lookup

fix(tls): serve every vhost the certificate of its own domain

2026-10-23 23:41:33 +02:00

__init__.py

…