fix: apply managed Nginx public entry without service restart

backend/internal/api/identity_gateway.go

@@ -38,6 +38,26 @@ func authGatewayPort(publicBase string) (int, error) {
 	return port, nil
 }
 
+func checkAuthGatewayChange(oldBase, newBase string) error {
+	if oldBase == "" || oldBase == newBase {
+		return nil
+	}
+	port, err := authGatewayPort(oldBase)
+	if err != nil {
+		return err
+	}
+	if port != 0 {
+		return &activeAuthEntry{}
+	}
+	return nil
+}
+
+type activeAuthEntry struct{}
+
+func (*activeAuthEntry) Error() string {
+	return "运行中的 OIDC 专线仍使用旧公网地址，请先停止或迁移专线"
+}
+
 type gatewayConflict struct{}
 
 func (*gatewayConflict) Error() string {

backend/internal/api/identity_gateway_test.go

@@ -29,6 +29,12 @@ func TestAuthGatewayPortFollowsRunningOIDCTunnel(t *testing.T) {
 		t.Fatal(err)
 	}
 	check(19090)
+	if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err == nil {
+		t.Fatal("active OIDC callback must block public entry change")
+	}
+	if err := checkAuthGatewayChange("https://vpn.example.com", "https://vpn.example.com"); err != nil {
+		t.Fatalf("unchanged public entry should be allowed: %v", err)
+	}
 	if port, err := authGatewayPort("https://other.example.com"); err != nil || port != 0 {
 		t.Fatalf("wrong domain routed: %d, %v", port, err)
 	}
@@ -36,4 +42,7 @@ func TestAuthGatewayPortFollowsRunningOIDCTunnel(t *testing.T) {
 		t.Fatal(err)
 	}
 	check(0)
+	if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err != nil {
+		t.Fatalf("stopped OIDC tunnel should allow change: %v", err)
+	}
 }

backend/internal/api/tls.go

@@ -26,14 +26,19 @@ func (s *Server) nginxSetupStatus(c *gin.Context) {
 
 func (s *Server) activateNginx(c *gin.Context) {
 	status := tlsservice.Status()
-	if status.Mode != "nginx" || status.ConfiguredMode != "nginx" || status.RestartRequired || status.ConfiguredDomain == "" {
-		c.JSON(http.StatusPreconditionFailed, gin.H{"error": "请先保存 Nginx 模式和公网入口，重启 opsx-vpn 后再启用站点"})
+	if status.Mode != "nginx" || status.ConfiguredMode != "nginx" || status.ConfiguredDomain == "" {
+		c.JSON(http.StatusPreconditionFailed, gin.H{"error": "请先启用 Nginx 模式并保存公网入口；切换入口模式需重启 opsx-vpn"})
 		return
 	}
 	scheme := status.ConfiguredScheme
 	if scheme == "" {
 		scheme = "https"
 	}
+	authPort, err := authGatewayPort(status.ConfiguredPublicBase)
+	if err != nil {
+		c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+		return
+	}
 	if !nginxgateway.Begin() {
 		c.JSON(http.StatusConflict, gin.H{"error": "入口配置正在运行，请等待完成"})
 		return
@@ -54,11 +59,15 @@ func (s *Server) activateNginx(c *gin.Context) {
 		write("info", "检查现有站点并启用 HTTP-01 验证。\n")
 	}
 	opts := nginxconfig.RenderOptions{Domain: status.ConfiguredDomain, Scheme: scheme, Port: status.ConfiguredPort}
-	if err := nginxgateway.RunEntry(opts, s.router.Routes(), func(message string) { write("output", message) }); err != nil {
+	if err := nginxgateway.RunEntryWithAuth(opts, s.router.Routes(), authPort, func(message string) { write("output", message) }); err != nil {
 		store.Audit(c.GetString("username"), "nginx_activate", "failed", err.Error())
 		write("error", err.Error())
 		return
 	}
+	if err := tlsservice.AdoptNginxConfiguration(service.BaseDir()); err != nil {
+		write("error", "站点已更新，但状态同步失败："+err.Error())
+		return
+	}
 	store.Audit(c.GetString("username"), "nginx_activate", "completed", status.ConfiguredPublicBase)
 	write("done", "站点和入口已就绪。")
 }
@@ -157,13 +166,48 @@ func (s *Server) setTLSDomain(c *gin.Context) {
 	if req.Port != nil {
 		port = *req.Port
 	}
+	status := tlsservice.Status()
+	newBase := tlsservice.PublicBaseURL(scheme, strings.ToLower(strings.TrimSpace(req.Domain)), port)
+	if newBase == "" || port < 0 || port > 65535 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "公网域名、协议或端口无效"})
+		return
+	}
+	// The Go listener cannot be rebound in place; Nginx owns its own sockets.
+	if status.Mode == "nginx" && status.ConfiguredMode == "nginx" && nginxgateway.Stage() != "none" {
+		s.gatewayMu.Lock()
+		defer s.gatewayMu.Unlock()
+		if err := checkAuthGatewayChange(status.PublicBase, newBase); err != nil {
+			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
+		authPort, err := authGatewayPort(newBase)
+		if err != nil {
+			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
+		opts := nginxconfig.RenderOptions{Domain: req.Domain, Scheme: scheme, Port: port}
+		err = nginxgateway.UpdateEntry(opts, status.ConfiguredDomain, s.router.Routes(), authPort, func() error {
+			if err := tlsservice.ConfigurePublicEntry(service.BaseDir(), scheme, req.Domain, port); err != nil {
+				return err
+			}
+			return tlsservice.AdoptNginxConfiguration(service.BaseDir())
+		})
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		store.Audit(c.GetString("username"), "tls_domain_applied", newBase, "Nginx 已重载")
+		c.JSON(http.StatusOK, gin.H{"status": tlsservice.Status(), "restart_required": false, "applied": true})
+		return
+	}
 	if err := tlsservice.ConfigurePublicEntry(service.BaseDir(), scheme, req.Domain, port); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 	store.Audit(c.GetString("username"), "tls_domain_configured", tlsservice.PublicBaseURL(scheme, strings.ToLower(strings.TrimSpace(req.Domain)), port), "需重启后生效")
-	status := tlsservice.Status()
-	c.JSON(http.StatusOK, gin.H{"status": status, "restart_required": status.RestartRequired})
+	status = tlsservice.Status()
+	c.JSON(http.StatusOK, gin.H{"status": status, "restart_required": status.RestartRequired,
+		"site_activation_required": status.Mode == "nginx" && status.ConfiguredMode == "nginx" && nginxgateway.Stage() == "none"})
 }
 
 func (s *Server) uploadTLSCertificate(c *gin.Context) {

backend/internal/nginxgateway/gateway.go

@@ -4,6 +4,8 @@ package nginxgateway
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"net"
@@ -72,7 +74,21 @@ func RefreshAuth(domain string, routes gin.RoutesInfo, authPort int) error {
 }
 
 func RefreshAuthEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, authPort int) error {
-	if Running() {
+	return refreshEntry(opts, routes, authPort, false, "", nil)
+}
+
+// UpdateEntry applies a validated public entry to an existing managed site.
+// persist is called after a successful reload; failure restores the old site.
+func UpdateEntry(opts nginxconfig.RenderOptions, expectedDomain string, routes gin.RoutesInfo, authPort int, persist func() error) error {
+	if !Begin() {
+		return errors.New("公网入口操作正在进行")
+	}
+	defer End()
+	return refreshEntry(opts, routes, authPort, true, expectedDomain, persist)
+}
+
+func refreshEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, authPort int, allowChange bool, expectedDomain string, persist func() error) error {
+	if Running() && !allowChange {
 		return errors.New("公网入口操作正在进行")
 	}
 	scheme := strings.ToLower(strings.TrimSpace(opts.Scheme))
@@ -88,7 +104,7 @@ func RefreshAuthEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, aut
 		return err
 	}
 	stage := Stage()
-	if scheme == "https" && stage != "https" {
+	if scheme == "https" && stage != "https" && !allowChange {
 		return errors.New("请先启用 HTTPS 站点")
 	}
 	if scheme == "http" && stage == "none" {
@@ -98,32 +114,80 @@ func RefreshAuthEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, aut
 	if err != nil {
 		return err
 	}
+	if allowChange && !strings.Contains(string(previous), "# Install this HTTP site first.") && !strings.Contains(string(previous), "# Plain HTTP public entry") {
+		return errors.New("现有站点不是 opsx-vpn 托管配置，拒绝覆盖")
+	}
+	if allowChange && (expectedDomain == "" || !strings.Contains(string(previous), "server_name "+expectedDomain+";")) {
+		return errors.New("现有站点域名与运行配置不匹配，拒绝覆盖")
+	}
 	domain := strings.ToLower(strings.TrimSpace(opts.Domain))
-	if !strings.Contains(string(previous), "server_name "+domain+";") {
+	if !allowChange && !strings.Contains(string(previous), "server_name "+domain+";") {
 		return errors.New("现有站点域名与配置不匹配")
 	}
+	if allowChange && scheme == "https" {
+		fullchain, privkey, _ := tlsservice.CertificateFiles(domain)
+		pair, err := tls.LoadX509KeyPair(fullchain, privkey)
+		if err != nil || len(pair.Certificate) == 0 {
+			return errors.New("目标域名没有可用的 HTTPS 证书，请先准备证书")
+		}
+		leaf, err := x509.ParseCertificate(pair.Certificate[0])
+		if err != nil || leaf.VerifyHostname(domain) != nil || time.Now().Before(leaf.NotBefore) || !time.Now().Before(leaf.NotAfter) {
+			return errors.New("目标域名证书无效或已过期")
+		}
+	}
+	if allowChange {
+		listenPort := tlsservice.EffectivePort(scheme, opts.Port)
+		portAlreadyManaged := strings.Contains(string(previous), fmt.Sprintf("listen %d;", listenPort)) ||
+			strings.Contains(string(previous), fmt.Sprintf("listen %d ssl", listenPort))
+		if !portAlreadyManaged {
+			listener, err := net.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", listenPort))
+			if err != nil {
+				return fmt.Errorf("目标端口 %d 已占用: %w", listenPort, err)
+			}
+			listener.Close()
+		}
+	}
 	httpSite, httpsSite, err := nginxconfig.RenderWithOptions(opts, routes, authPort)
 	if err != nil {
 		return err
 	}
 	if string(previous) == httpSite+httpsSite {
+		if persist != nil {
+			return persist()
+		}
 		return nil
 	}
-	if err := writeSite(httpSite + httpsSite); err != nil {
+	validate := func() error { return command(func(string) {}, 15*time.Second, "nginx", "-t") }
+	reload := func() error { return command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx") }
+	return swapManagedSite(string(previous), httpSite+httpsSite, persist, writeSite, validate, reload)
+}
+
+func swapManagedSite(previous, next string, persist func() error, write func(string) error, validate, reload func() error) error {
+	if err := write(next); err != nil {
 		return err
 	}
-	rollback := func() {
-		_ = writeSite(string(previous))
-		_ = command(func(string) {}, 15*time.Second, "nginx", "-t")
-		_ = command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx")
+	rollback := func(cause error) error {
+		if err := write(previous); err != nil {
+			return fmt.Errorf("%w；恢复旧站点失败: %v", cause, err)
+		}
+		if err := validate(); err != nil {
+			return fmt.Errorf("%w；旧站点配置校验失败: %v", cause, err)
+		}
+		if err := reload(); err != nil {
+			return fmt.Errorf("%w；恢复旧站点重载失败: %v", cause, err)
+		}
+		return cause
 	}
-	if err := command(func(string) {}, 15*time.Second, "nginx", "-t"); err != nil {
-		rollback()
-		return err
+	if err := validate(); err != nil {
+		return rollback(err)
 	}
-	if err := command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx"); err != nil {
-		rollback()
-		return err
+	if err := reload(); err != nil {
+		return rollback(err)
+	}
+	if persist != nil {
+		if err := persist(); err != nil {
+			return rollback(err)
+		}
 	}
 	return nil
 }
@@ -246,6 +310,12 @@ func Run(domain string, routes gin.RoutesInfo, emit func(string)) error {
 
 // RunEntry activates the public entry for the given scheme/port. HTTP skips ACME.
 func RunEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, emit func(string)) error {
+	return RunEntryWithAuth(opts, routes, 0, emit)
+}
+
+// RunEntryWithAuth preserves a running OpenVPN browser-auth upstream when
+// regenerating an already managed site.
+func RunEntryWithAuth(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, authPort int, emit func(string)) error {
 	domain := strings.ToLower(strings.TrimSpace(opts.Domain))
 	scheme := strings.ToLower(strings.TrimSpace(opts.Scheme))
 	if scheme == "" {
@@ -265,7 +335,7 @@ func RunEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, emit func(s
 	} else if err := checkSites(); err != nil {
 		return err
 	}
-	httpSite, httpsSite, err := nginxconfig.RenderWithOptions(opts, routes, 0)
+	httpSite, httpsSite, err := nginxconfig.RenderWithOptions(opts, routes, authPort)
 	if err != nil {
 		return err
 	}

backend/internal/nginxgateway/gateway_test.go

@@ -0,0 +1,42 @@
+package nginxgateway
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestSwapManagedSiteRestoresPreviousOnFailure(t *testing.T) {
+	for _, failAt := range []string{"validate", "reload", "persist"} {
+		t.Run(failAt, func(t *testing.T) {
+			site := "old"
+			validations, reloads := 0, 0
+			write := func(content string) error { site = content; return nil }
+			validate := func() error {
+				validations++
+				if failAt == "validate" && site == "new" {
+					return errors.New("invalid nginx config")
+				}
+				return nil
+			}
+			reload := func() error {
+				reloads++
+				if failAt == "reload" && site == "new" {
+					return errors.New("reload failed")
+				}
+				return nil
+			}
+			persist := func() error {
+				if failAt == "persist" {
+					return errors.New("save failed")
+				}
+				return nil
+			}
+			if err := swapManagedSite("old", "new", persist, write, validate, reload); err == nil {
+				t.Fatal("expected failure")
+			}
+			if site != "old" || validations < 2 || reloads < 1 {
+				t.Fatalf("old site not restored: site=%s validations=%d reloads=%d", site, validations, reloads)
+			}
+		})
+	}
+}

backend/internal/tlsservice/tlsservice.go

@@ -282,6 +282,25 @@ func ConfigureMode(dataDir, mode string) error {
 	return writePersisted(dataDir, "tls-mode", mode)
 }
 
+// AdoptNginxConfiguration updates the in-process public address after the
+// managed Nginx site has passed validation and reloaded successfully.
+func AdoptNginxConfiguration(dataDir string) error {
+	config, err := configFromEnvironment(dataDir)
+	if err != nil {
+		return err
+	}
+	if config.mode != "nginx" {
+		return fmt.Errorf("当前入口不是 Nginx 模式")
+	}
+	state.Lock()
+	defer state.Unlock()
+	if state.config.mode != "nginx" || state.config.dataDir != dataDir {
+		return fmt.Errorf("运行模式不支持热更新 Nginx 入口")
+	}
+	state.config = config
+	return nil
+}
+
 // Start keeps certificates in the persistent data directory. Issuance occurs
 // on the first TLS handshake, and autocert handles renewal.
 func Start(handler http.Handler, dataDir string) error {
@@ -377,8 +396,8 @@ func Status() CertificateStatus {
 		status.ConfiguredScheme = normalizeScheme(desired.scheme)
 		status.ConfiguredPort = desired.port
 		status.ConfiguredPublicBase = PublicBaseURL(status.ConfiguredScheme, desired.domain, desired.port)
-		status.RestartRequired = desired.domain != config.domain || desired.mode != config.mode ||
-			normalizeScheme(desired.scheme) != scheme || desired.port != config.port
+		status.RestartRequired = desired.mode != config.mode || (config.mode != "nginx" &&
+			(desired.domain != config.domain || normalizeScheme(desired.scheme) != scheme || desired.port != config.port))
 	}
 	if config.mode == "nginx" {
 		// Certbot or uploaded PEMs own HTTPS certificates. HTTP needs no leaf.

backend/internal/tlsservice/tlsservice_test.go

@@ -89,6 +89,35 @@ func TestNginxModeDoesNotBindGoListeners(t *testing.T) {
 	}
 }
 
+func TestNginxEntryCanAdoptWithoutRestart(t *testing.T) {
+	t.Setenv("VPN_TLS_MODE", "")
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	t.Setenv("VPN_TLS_SCHEME", "")
+	t.Setenv("VPN_TLS_PORT", "")
+	dir := t.TempDir()
+	if err := ConfigureMode(dir, "nginx"); err != nil {
+		t.Fatal(err)
+	}
+	if err := ConfigurePublicEntry(dir, "https", "first.example.com", 443); err != nil {
+		t.Fatal(err)
+	}
+	if err := Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	if err := ConfigurePublicEntry(dir, "http", "second.example.com", 8080); err != nil {
+		t.Fatal(err)
+	}
+	if s := Status(); s.PublicBase == "http://second.example.com:8080" || s.RestartRequired {
+		t.Fatalf("unapplied nginx config must not claim the new entry or require process restart: %+v", s)
+	}
+	if err := AdoptNginxConfiguration(dir); err != nil {
+		t.Fatal(err)
+	}
+	if s := Status(); s.RestartRequired || s.ConfiguredPublicBase != "http://second.example.com:8080" || s.PublicBase != s.ConfiguredPublicBase {
+		t.Fatalf("nginx config was not adopted: %+v", s)
+	}
+}
+
 func TestPublicBaseURL(t *testing.T) {
 	cases := []struct {
 		scheme, host string

docs/specs/SDD-005-nginx-live-public-entry.md

@@ -0,0 +1,61 @@
+# SDD-005：Nginx 公网入口保存后即时生效
+
+| 字段 | 内容 |
+|---|---|
+| 版本 / 变更级别 | 0.1 / S3 |
+| 设计状态 | 已形成 |
+| 实现状态 | 已实现；本地 Go 测试及前端构建通过，生产热切换未演练 |
+| 负责人 / 日期 | opsx-vpn / 2026-10-26 |
+| 关联需求 | 在 Nginx 模式修改 HTTP/HTTPS 公网入口，无须重启管理进程；管理端口保持 18080 |
+| 批准状态 | 用户提出修改 |
+
+## 1. 背景、目标与范围
+
+- 现状：`api.setTLSDomain` 仅调用 `tlsservice.ConfigurePublicEntry` 写入 `data/tls-*`；`tlsservice.Status` 比较启动配置并要求重启。`nginxgateway.RefreshAuthEntry` 只能刷新同域名；页面先保存域名再另存模式，显示不准确的“重启后监听 80/443”。
+- 目标：已运行 Nginx 模式、已有托管站点时，保存协议、域名或端口会重写托管 Nginx 配置、`nginx -t` 和 reload，成功后更新内存配置及状态，返回即时生效；入口始终反代现有 18080 管理服务。
+- 边界：首次安装/启用站点依旧单独执行并提供申请证书的日志；Go autocert 模式和入口模式切换仍需重启，因为涉及 Go 监听器。生产当前 HTTPS 入口不自动切换到 HTTP。
+- 保留：原 HTTP-01 路由白名单、已有 OpenVPN/OIDC 回调、证书路径及未提交文件。
+
+## 2. 需求与约束
+
+- FR-01：已启用 Nginx 站点时保存公网入口即时更新站点及状态，不改变应用管理监听端口。
+- FR-02：失败时包括缺失/过期目标证书、端口冲突、`nginx -t`/reload 或配置持久化失败，恢复旧站点和旧状态并返回具体错误。
+- FR-03：首次配置但尚无托管站点时，保存后提示“待启用站点”，点击启用后无须重启；切换进程入口模式明确提示重启。
+- FR-04：运行中的 OpenVPN OIDC 使用旧公网回调时，禁止修改会使其回调失效的入口地址。
+- NFR-01：只允许管理员修改；拒绝覆盖不属于本应用的站点；更新操作与证书上传/身份路由刷新互斥。
+
+## 3. 架构与方案
+
+保存接口按运行模式分支：Nginx 托管站点先校验新域名证书与活跃 OIDC 引用，在锁内生成站点、备份原内容、原子替换、测试及 reload，再持久化公网配置并更新 `tlsservice` 内存；任何步骤失败回滚站点与配置。未启用站点只保存草稿；启用站点成功后更新内存。Go 模式原有需重启语义保留。前端按 `restart_required`、`site_activation_required` 和 `applied` 分别提示。
+
+## 4. 接口、数据与配置契约
+
+- `PUT /api/system/tls/domain` 请求体仍为 `{domain, scheme, port}`，响应增加 `applied` 与 `site_activation_required`；模式接口不变。
+- `GET /api/system/tls` 继续提供配置/运行状态；已完成热更新时 `restart_required=false`。
+- 没有数据库迁移或新配置文件。`VPN_TLS_*` 环境变量仍优先且不能被 UI 覆盖。
+
+## 5. 风险与验收
+
+| 风险或失败场景 | 防护 / 恢复 | 可观察信号 |
+|---|---|---|
+| 新入口证书不可用 | 拒绝 HTTPS 切换，旧站点不动 | 4xx 及原证书继续可用 |
+| Nginx 校验/重载失败 | 恢复站点并重新 reload；返回错误 | 5xx、`nginx -t`、健康检查 |
+| 已连接 OIDC 专线回调旧地址 | 拒绝修改公网地址 | 409 与原专线可用 |
+| 旧站点归属不明 | 拒绝覆盖 | 错误提示；人工检查 |
+
+| AC | 对应需求 | 前置与操作 | 预期结果 | 验证方式 | 结果 |
+|---|---|---|---|---|---|
+| AC-01 | FR-01, NFR-01 | Nginx HTTPS 已启用，保存相同域名/端口 | 不重启，健康检查可用，状态即时同步 | 单测、实机回归 | 状态更新单测通过；在线保存待验证 |
+| AC-02 | FR-02 | 无证书、无效端口或模拟 reload 失败 | 不丢失旧入口、状态不变化 | 单测与配置检查 | 回滚单测通过；在线异常待验证 |
+| AC-03 | FR-03 | 尚未启用站点保存，再启用 | 不要求重启；Go 模式仍准确提醒 | 单测、前端构建 | 本地通过；首次启用实机待验证 |
+| AC-04 | FR-04 | 有 OIDC 专线运行时修改回调根地址 | 拒绝并保留原站点 | API 模块测试 | 本地拒绝与停用后放行测试通过；在线拒绝路径待验证 |
+
+## 6. 发布与恢复
+
+本地 Go 测试、前端构建通过后提交。若部署，先备份程序/数据库和托管站点，保持 HTTPS 现状，先构建前端和后端，再切换管理进程。核验公网 HTTPS、OIDC 发现、`nginx -t`、OpenVPN 进程与 18080 健康。故障时恢复旧程序和站点并 reload；不删除证书或 `data/`。不计划在线演练切换为 HTTP。
+
+## 7. 待决问题
+
+| 问题 | 是否阻塞 | 推荐方案 |
+|---|---|---|
+| 新域名尚无证书时是否自动签发 | 不阻塞即时更新已配置站点 | 拒绝带故障风险的热切换，先通过证书流程准备证书；未来单独设计零停机多域名签发 |

frontend/src/locales/en-US.json

@@ -900,21 +900,23 @@
     "domain": "Configured domain",
     "activeDomain": "Active domain",
     "saveDomain": "Save domain",
-    "restartRequired": "Domain saved; restart OpsX VPN to enable ports 80/443 and automatic issuance",
+    "restartRequired": "Gateway mode saved; switching between Go and Nginx requires restarting the management service",
+    "siteActivationRequired": "Entry saved; prepare and enable the Nginx site below for first use",
+    "applied": "Public entry updated; Nginx configuration is active",
     "saveFailed": "Could not save domain",
     "dns": "DNS",
     "certificate": "Certificate",
     "valid": "Valid",
     "pending": "Pending first HTTPS handshake",
     "notConfigured": "Disabled",
-    "saved": "Domain configuration saved",
+    "saved": "Public entry saved",
     "issuer": "Issuer",
     "expires": "Expires",
     "renewal": "Renewal",
     "automatic": "Automatic (autocert)",
     "ports": "HTTP / HTTPS ports",
     "externalPorts": "Managed by external Nginx; listener status not checked",
-    "setupHint": "Restart to apply a saved domain or mode. Before switching to Nginx, follow the deployment guide to install it, issue a certificate, and validate the configuration. Go mode caches certificates in data/acme; saving settings alone does not issue a certificate.",
+    "setupHint": "Changes to an active Nginx gateway apply on save. Prepare a certificate for initial setup. Only switching between Go and Nginx modes requires a restart.",
     "refresh": "Refresh status",
     "openHttps": "Open HTTPS health check",
     "loadFailed": "Could not load certificate status",
@@ -922,7 +924,7 @@
     "goMode": "Go automatic certificate (binds 80/443)",
     "nginxMode": "Nginx proxy (external 80/443)",
     "saveMode": "Save entry mode",
-    "nginxHint": "Save the Nginx mode and domain, restart the service, then enable the site and request a certificate. Public ports 80/443 must be open.",
+    "nginxHint": "An active Nginx gateway reloads on save. Initial setup requires enabling the site separately; the management service remains on port 18080.",
     "externalRenewal": "Managed by Certbot",
     "previewNginx": "Preview Nginx configuration",
     "previewOnly": "Configuration preview; HTTP handles issuance and HTTPS starts after the certificate exists.",

frontend/src/locales/zh-CN.json

@@ -900,21 +900,23 @@
     "domain": "配置域名",
     "activeDomain": "当前监听域名",
     "saveDomain": "保存域名",
-    "restartRequired": "域名已保存，重启 opsx-vpn 后才会监听 80/443 并启用自动签发",
+    "restartRequired": "入口模式已保存；切换 Go 与 Nginx 模式需重启管理服务",
+    "siteActivationRequired": "入口已保存；首次启用站点请到下方准备并启用 Nginx",
+    "applied": "公网入口已更新，Nginx 配置已生效",
     "saveFailed": "保存域名失败",
     "dns": "DNS 解析",
     "certificate": "证书",
     "valid": "有效",
     "pending": "等待首次 HTTPS 请求签发",
     "notConfigured": "未启用",
-    "saved": "域名配置已保存",
+    "saved": "公网入口已保存",
     "issuer": "颁发者",
     "expires": "到期时间",
     "renewal": "续签",
     "automatic": "自动（autocert）",
     "ports": "HTTP / HTTPS 端口",
     "externalPorts": "由外部 Nginx 管理，尚未检测监听状态",
-    "setupHint": "保存域名或入口模式后需重启生效；切换为 Nginx 前须按部署文档完成安装、证书签发和配置校验。Go 模式证书缓存于 data/acme；保存配置本身不会签发证书。",
+    "setupHint": "已启用的 Nginx 入口保存后立即生效；首次启用站点需准备证书。只有切换 Go 与 Nginx 模式才需重启。",
     "refresh": "刷新状态",
     "openHttps": "打开 HTTPS 健康检查",
     "loadFailed": "读取证书状态失败",
@@ -922,7 +924,7 @@
     "goMode": "Go 自动证书（进程监听 80/443）",
     "nginxMode": "Nginx 代理（外部监听 80/443）",
     "saveMode": "保存入口模式",
-    "nginxHint": "选择 Nginx 模式并保存域名后重启服务，再点击启用站点申请证书。端口 80/443 需允许公网访问。",
+    "nginxHint": "已启用的 Nginx 入口保存后立即重载；首次配置需单独启用站点。管理服务继续监听 18080。",
     "externalRenewal": "由 Certbot 管理",
     "previewNginx": "预览 Nginx 配置",
     "previewOnly": "以下为配置预览；HTTP 站点用于签发，HTTPS 站点在证书存在后启用。",

frontend/src/views/settings/components/GatewaySettings.vue

@@ -54,6 +54,7 @@
       </el-form>
 
       <el-alert v-if="tlsStatus?.restart_required" type="warning" :closable="false" :title="$t('tls.restartRequired')" style="margin-top:12px" />
+      <el-alert v-else-if="entry.mode === 'nginx' && nginxSetup?.site_stage === 'none' && tlsStatus?.configured_domain" type="info" :closable="false" :title="$t('tls.siteActivationRequired')" style="margin-top:12px" />
       <el-alert v-if="tlsStatus?.management_direct_public" type="warning" :closable="false" :title="$t('tls.directPortWarning')" style="margin-top:12px" />
     </el-card>
 
@@ -383,16 +384,22 @@ async function savePublicEntry() {
   if (!entry.host) return ElMessage.warning(t('tls.hostRequired'))
   tlsSaving.value = true
   try {
+    let modeRes = null
+    if (entry.mode !== tlsStatus.value?.configured_mode) {
+      const result = await api.put('/system/tls/mode', { mode: entry.mode })
+      modeRes = result.data
+    }
     const { data: domainRes } = await api.put('/system/tls/domain', {
       domain: entry.host,
       scheme: entry.scheme,
       port: entry.port,
     })
     tlsStatus.value = domainRes.status
-    const { data: modeRes } = await api.put('/system/tls/mode', { mode: entry.mode })
-    tlsStatus.value = modeRes.status || domainRes.status
     nginxPreview.value = null
-    ElMessage.success((domainRes.restart_required || modeRes.restart_required) ? t('tls.restartRequired') : t('tls.saved'))
+    if (domainRes.restart_required || modeRes?.restart_required) ElMessage.success(t('tls.restartRequired'))
+    else if (domainRes.site_activation_required) ElMessage.success(t('tls.siteActivationRequired'))
+    else ElMessage.success(t(domainRes.applied ? 'tls.applied' : 'tls.saved'))
+    await refreshAll()
   } catch (e) { ElMessage.error(e.response?.data?.error || t('tls.saveFailed')) }
   finally { tlsSaving.value = false }
 }