fix: preserve live Nginx entry when saved draft differs

backend/internal/api/identity_gateway.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -71,7 +72,7 @@ func (s *Server) RefreshManagedGatewayOnStart() error {
 	s.gatewayMu.Lock()
 	defer s.gatewayMu.Unlock()
 	status := tlsservice.Status()
-	if status.Mode != "nginx" || status.RestartRequired || status.Domain == "" || status.PublicBase == "" {
+	if status.Mode != "nginx" || status.RestartRequired {
 		return nil
 	}
 	scheme := status.Scheme
@@ -79,6 +80,22 @@ func (s *Server) RefreshManagedGatewayOnStart() error {
 		scheme = "https"
 	}
 	stage := nginxgateway.Stage()
+	if stage != "none" {
+		actual, err := nginxgateway.ManagedEntry()
+		if err != nil {
+			return err
+		}
+		actualBase := tlsservice.PublicBaseURL(actual.Scheme, actual.Domain, actual.Port)
+		if actualBase != status.ConfiguredPublicBase {
+			if err := tlsservice.UseManagedNginxEntry(service.BaseDir(), actual.Scheme, actual.Domain, actual.Port); err != nil {
+				return err
+			}
+			return fmt.Errorf("已保存的公网入口 %s 与运行中的 Nginx %s 不同；保留当前站点，请在设置页确认后保存", status.ConfiguredPublicBase, actualBase)
+		}
+	}
+	if status.Domain == "" || status.PublicBase == "" {
+		return nil
+	}
 	if scheme == "https" && (!status.Valid || stage != "https") {
 		return nil
 	}

backend/internal/api/tls.go

@@ -176,6 +176,11 @@ func (s *Server) setTLSDomain(c *gin.Context) {
 	if status.Mode == "nginx" && status.ConfiguredMode == "nginx" && nginxgateway.Stage() != "none" {
 		s.gatewayMu.Lock()
 		defer s.gatewayMu.Unlock()
+		actual, err := nginxgateway.ManagedEntry()
+		if err != nil {
+			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
 		if err := checkAuthGatewayChange(status.PublicBase, newBase); err != nil {
 			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
 			return
@@ -186,7 +191,7 @@ func (s *Server) setTLSDomain(c *gin.Context) {
 			return
 		}
 		opts := nginxconfig.RenderOptions{Domain: req.Domain, Scheme: scheme, Port: port}
-		err = nginxgateway.UpdateEntry(opts, status.ConfiguredDomain, s.router.Routes(), authPort, func() error {
+		err = nginxgateway.UpdateEntry(opts, actual.Domain, s.router.Routes(), authPort, func() error {
 			if err := tlsservice.ConfigurePublicEntry(service.BaseDir(), scheme, req.Domain, port); err != nil {
 				return err
 			}