fix: apply managed Nginx public entry without service restart

backend/internal/tlsservice/tlsservice_test.go

@@ -89,6 +89,35 @@ func TestNginxModeDoesNotBindGoListeners(t *testing.T) {
 	}
 }
 
+func TestNginxEntryCanAdoptWithoutRestart(t *testing.T) {
+	t.Setenv("VPN_TLS_MODE", "")
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	t.Setenv("VPN_TLS_SCHEME", "")
+	t.Setenv("VPN_TLS_PORT", "")
+	dir := t.TempDir()
+	if err := ConfigureMode(dir, "nginx"); err != nil {
+		t.Fatal(err)
+	}
+	if err := ConfigurePublicEntry(dir, "https", "first.example.com", 443); err != nil {
+		t.Fatal(err)
+	}
+	if err := Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	if err := ConfigurePublicEntry(dir, "http", "second.example.com", 8080); err != nil {
+		t.Fatal(err)
+	}
+	if s := Status(); s.PublicBase == "http://second.example.com:8080" || s.RestartRequired {
+		t.Fatalf("unapplied nginx config must not claim the new entry or require process restart: %+v", s)
+	}
+	if err := AdoptNginxConfiguration(dir); err != nil {
+		t.Fatal(err)
+	}
+	if s := Status(); s.RestartRequired || s.ConfiguredPublicBase != "http://second.example.com:8080" || s.PublicBase != s.ConfiguredPublicBase {
+		t.Fatalf("nginx config was not adopted: %+v", s)
+	}
+}
+
 func TestPublicBaseURL(t *testing.T) {
 	cases := []struct {
 		scheme, host string