feat(tls): manage ACME domain and add desktop client settings

backend/internal/api/api.go

@@ -284,6 +284,8 @@ func (s *Server) RegisterRoutes(r *gin.Engine) {
 		// 主机环境体检与一键初始化（仅 admin）
 		admin.GET("/system/env", s.systemEnv)
 		admin.POST("/system/fix", s.systemFix)
+		admin.GET("/system/tls", s.tlsStatus)
+		admin.PUT("/system/tls/domain", s.setTLSDomain)
 		admin.GET("/users", s.listUsers)
 		admin.POST("/users", s.createUser)
 		admin.PUT("/users/:id", s.updateUser)

backend/internal/api/tls.go

@@ -0,0 +1,32 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"vpn-platform/backend/internal/service"
+	"vpn-platform/backend/internal/store"
+	"vpn-platform/backend/internal/tlsservice"
+)
+
+func (s *Server) tlsStatus(c *gin.Context) {
+	c.JSON(http.StatusOK, tlsservice.Status())
+}
+
+func (s *Server) setTLSDomain(c *gin.Context) {
+	var req struct {
+		Domain string `json:"domain"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "请输入域名"})
+		return
+	}
+	if err := tlsservice.ConfigureDomain(service.BaseDir(), req.Domain); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	store.Audit(c.GetString("username"), "tls_domain_configured", req.Domain, "需重启后生效")
+	status := tlsservice.Status()
+	c.JSON(http.StatusOK, gin.H{"status": status, "restart_required": status.RestartRequired})
+}

backend/internal/api/tls_test.go

@@ -0,0 +1,49 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestTLSStatusRequiresAdmin(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.GET("/api/system/tls", func(c *gin.Context) {
+		c.Set("role", c.GetHeader("X-Test-Role"))
+		c.Next()
+	}, requireRole("admin"), (&Server{}).tlsStatus)
+
+	for _, role := range []string{"", "viewer", "operator"} {
+		req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
+		req.Header.Set("X-Test-Role", role)
+		resp := httptest.NewRecorder()
+		router.ServeHTTP(resp, req)
+		if resp.Code != http.StatusForbidden {
+			t.Errorf("role %q received HTTP %d", role, resp.Code)
+		}
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
+	req.Header.Set("X-Test-Role", "admin")
+	resp := httptest.NewRecorder()
+	router.ServeHTTP(resp, req)
+	if resp.Code != http.StatusOK {
+		t.Fatalf("admin received HTTP %d", resp.Code)
+	}
+	var data map[string]any
+	if err := json.Unmarshal(resp.Body.Bytes(), &data); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := data["configured_domain"]; !ok {
+		t.Fatal("admin response missing configured domain")
+	}
+	for _, secret := range []string{"private_key", "account_key", "certificate_pem"} {
+		if _, ok := data[secret]; ok {
+			t.Errorf("response exposes %s", secret)
+		}
+	}
+}