Add guarded IP certificate flow and renewal history

backend/internal/nginxgateway/gateway_test.go

@@ -2,6 +2,7 @@ package nginxgateway
 
 import (
 	"errors"
+	"strings"
 	"testing"
 
 	"vpn-platform/backend/internal/nginxconfig"
@@ -13,6 +14,7 @@ func TestParseManagedEntry(t *testing.T) {
 		{Domain: "vpn.example.com", Scheme: "https", Port: 8443},
 		{Domain: "vpn.example.com", Scheme: "http", Port: 28080},
 		{Domain: "121.4.111.208", Scheme: "http", Port: 28080},
+		{Domain: "121.4.111.208", Scheme: "https", Port: 28080},
 	} {
 		httpSite, httpsSite, err := nginxconfig.RenderWithOptions(want, nil, 0)
 		if err != nil {
@@ -28,6 +30,21 @@ func TestParseManagedEntry(t *testing.T) {
 	}
 }
 
+func TestIPCertificateRequiresWebrootCapableCertbot(t *testing.T) {
+	for _, version := range []string{"certbot 2.9.0", "certbot 5.3.1", "unknown"} {
+		if _, err := ipCertificateArgsForVersion("121.4.111.208", version); err == nil {
+			t.Fatalf("accepted unsupported version %q", version)
+		}
+	}
+	args, err := ipCertificateArgsForVersion("121.4.111.208", "certbot 5.4.0")
+	if err != nil || strings.Join(args, " ") != "--preferred-profile shortlived --ip-address 121.4.111.208" {
+		t.Fatalf("unexpected IP ACME flags %q: %v", args, err)
+	}
+	if !strings.Contains(renewalHook(), "RENEWED_LINEAGE") || !strings.Contains(renewalHook(), "cert-renewals.log") {
+		t.Fatal("deploy hook must record a successful renewal")
+	}
+}
+
 func TestSwapManagedSiteRestoresPreviousOnFailure(t *testing.T) {
 	for _, failAt := range []string{"validate", "reload", "persist"} {
 		t.Run(failAt, func(t *testing.T) {