Add managed Nginx HTTP-01 gateway activation and certificate status

backend/internal/api/api.go

@@ -306,6 +306,7 @@ func (s *Server) RegisterRoutes(r *gin.Engine) {
 		admin.GET("/system/tls/nginx-preview", s.nginxPreview)
 		admin.GET("/system/tls/nginx-setup", s.nginxSetupStatus)
 		admin.POST("/system/tls/nginx-setup", s.initializeNginx)
+		admin.POST("/system/tls/nginx-activate", s.activateNginx)
 		admin.GET("/users", s.listUsers)
 		admin.POST("/users", s.createUser)
 		admin.PUT("/users/:id", s.updateUser)

backend/internal/api/tls.go

@@ -8,6 +8,7 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"vpn-platform/backend/internal/nginxconfig"
+	"vpn-platform/backend/internal/nginxgateway"
 	"vpn-platform/backend/internal/nginxsetup"
 	"vpn-platform/backend/internal/service"
 	"vpn-platform/backend/internal/store"
@@ -15,7 +16,41 @@ import (
 )
 
 func (s *Server) nginxSetupStatus(c *gin.Context) {
-	c.JSON(http.StatusOK, nginxsetup.Inspect())
+	status := nginxsetup.Inspect()
+	c.JSON(http.StatusOK, gin.H{"os": status.OS, "version": status.Version, "package_manager": status.PackageManager,
+		"supported": status.Supported, "root": status.Root, "nginx_installed": status.Nginx,
+		"certbot_installed": status.Certbot, "webroot_ready": status.Webroot, "running": status.Running || nginxgateway.Running(),
+		"site_stage": nginxgateway.Stage()})
+}
+
+func (s *Server) activateNginx(c *gin.Context) {
+	status := tlsservice.Status()
+	if status.Mode != "nginx" || status.ConfiguredMode != "nginx" || status.RestartRequired || status.ConfiguredDomain == "" {
+		c.JSON(http.StatusPreconditionFailed, gin.H{"error": "请先保存 Nginx 模式和域名，重启 opsx-vpn 后再启用站点"})
+		return
+	}
+	if !nginxgateway.Begin() {
+		c.JSON(http.StatusConflict, gin.H{"error": "入口配置正在运行，请等待完成"})
+		return
+	}
+	defer nginxgateway.End()
+	c.Header("Content-Type", "application/x-ndjson; charset=utf-8")
+	c.Header("Cache-Control", "no-store")
+	c.Header("X-Accel-Buffering", "no")
+	c.Status(http.StatusOK)
+	write := func(kind, message string) {
+		payload, _ := json.Marshal(gin.H{"type": kind, "message": message})
+		fmt.Fprintf(c.Writer, "%s\n", payload)
+		c.Writer.Flush()
+	}
+	write("info", "检查现有站点并启用 HTTP-01 验证。\n")
+	if err := nginxgateway.Run(status.ConfiguredDomain, s.router.Routes(), func(message string) { write("output", message) }); err != nil {
+		store.Audit(c.GetString("username"), "nginx_activate", "failed", err.Error())
+		write("error", err.Error())
+		return
+	}
+	store.Audit(c.GetString("username"), "nginx_activate", "completed", status.ConfiguredDomain)
+	write("done", "站点和证书已就绪。")
 }
 
 func (s *Server) initializeNginx(c *gin.Context) {