Add managed Nginx HTTP-01 gateway activation and certificate status

backend/internal/tlsservice/tlsservice.go

@@ -228,9 +228,13 @@ func Status() CertificateStatus {
 		status.RestartRequired = desired.domain != config.domain || desired.mode != config.mode
 	}
 	if config.mode == "nginx" {
-		// In proxy mode, certbot owns the certificate; the Go service does not
-		// claim that Nginx is listening merely because a domain was saved.
+		// Certbot owns this certificate. Read only the public certificate and
+		// never mistake a configured domain for a listening HTTPS gateway.
 		status.Domain = ""
+		if config.domain != "" {
+			readCertificate(filepath.Join("/etc/letsencrypt/live", config.domain, "fullchain.pem"), config.domain, &status)
+			if status.Valid { status.Domain = config.domain }
+		}
 		return status
 	}
 	if !status.Enabled {
@@ -248,6 +252,18 @@ func Status() CertificateStatus {
 		return status
 	}
 	_, data = pem.Decode(data)
+	readCertificateBytes(data, config.domain, &status)
+	return status
+}
+
+func readCertificate(path, domain string, status *CertificateStatus) {
+	data, err := os.ReadFile(path)
+	if err == nil {
+		readCertificateBytes(data, domain, status)
+	}
+}
+
+func readCertificateBytes(data []byte, domain string, status *CertificateStatus) {
 	for len(data) > 0 {
 		block, rest := pem.Decode(data)
 		if block == nil {
@@ -258,7 +274,7 @@ func Status() CertificateStatus {
 			continue
 		}
 		cert, err := x509.ParseCertificate(block.Bytes)
-		if err != nil || cert.VerifyHostname(config.domain) != nil {
+		if err != nil || cert.VerifyHostname(domain) != nil {
 			break
 		}
 		status.Cached = true
@@ -268,5 +284,4 @@ func Status() CertificateStatus {
 		status.Valid = time.Now().After(cert.NotBefore) && time.Now().Before(cert.NotAfter)
 		break
 	}
-	return status
 }