From a7d859681f5508a829115376d9dd993f3f137321 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Mon, 3 Aug 2026 10:27:49 +0300
Subject: frontends: give f3s hosts a standby.<host> SAN instead of a separate
 cert

f3s hosts don't get a distinct standby certificate/keypair; alias the
primary cert's files under the standby name (relayd selects a keypair
by SNI, so it needs matching filenames) and add standby.<host> as a
SAN on the primary cert. Every host now also gets www.<host> as a SAN
unconditionally, since public DNS publishes www for all of them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 frontends/Rexfile                  | 12 ++++++++++--
 frontends/etc/acme-client.conf.tpl | 11 ++++++-----
 frontends/etc/relayd.conf.tpl      |  2 --
 frontends/scripts/acme.sh.tpl      | 17 ++++++++++++++++-
 4 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/frontends/Rexfile b/frontends/Rexfile
index 21c2f58..3dd3c43 100644
--- a/frontends/Rexfile
+++ b/frontends/Rexfile
@@ -296,13 +296,21 @@ task 'acme',
   group => 'frontends',
   sub {
     file '/etc/acme-client.conf',
-      content => template( './etc/acme-client.conf.tpl', acme_hosts => \@acme_hosts ),
+      content => template(
+        './etc/acme-client.conf.tpl',
+        acme_hosts => \@acme_hosts,
+        f3s_hosts  => \@f3s_hosts
+      ),
       owner   => 'root',
       group   => 'wheel',
       mode    => '644';
 
     file '/usr/local/bin/acme.sh',
-      content => template( './scripts/acme.sh.tpl', acme_hosts => \@acme_hosts ),
+      content => template(
+        './scripts/acme.sh.tpl',
+        acme_hosts => \@acme_hosts,
+        f3s_hosts  => \@f3s_hosts
+      ),
       owner   => 'root',
       group   => 'wheel',
       mode    => '744';
diff --git a/frontends/etc/acme-client.conf.tpl b/frontends/etc/acme-client.conf.tpl
index 0c9671d..727e7fe 100644
--- a/frontends/etc/acme-client.conf.tpl
+++ b/frontends/etc/acme-client.conf.tpl
@@ -28,11 +28,12 @@ authority buypass-test {
      # Skip ipv4/ipv6 subdomains - they're included as SANs in parent cert
      next if $host =~ /^(ipv4|ipv6)\./;
 -%>
-<%   # Check if this host has ipv4/ipv6 subdomains that need to be included as SANs
-     my @alt_names;
-     # Don't add www prefix for f3s hosts - they don't have DNS records for www variants
-     unless (grep { $_ eq $host } @$f3s_hosts) {
-         push @alt_names, "www.$host";
+<%   # Public DNS publishes www for every service. f3s hosts use the primary
+     # certificate for standby too (unlike other hosts, they do not get a
+     # separate standby certificate/keypair).
+     my @alt_names = ("www.$host");
+     if (grep { $_ eq $host } @$f3s_hosts) {
+         push @alt_names, "standby.$host";
      }
      for my $sub_host (@$acme_hosts) {
          if ($sub_host =~ /^(ipv4|ipv6)\.\Q$host\E$/) {
diff --git a/frontends/etc/relayd.conf.tpl b/frontends/etc/relayd.conf.tpl
index 8a53ed3..74a90f1 100644
--- a/frontends/etc/relayd.conf.tpl
+++ b/frontends/etc/relayd.conf.tpl
@@ -71,10 +71,8 @@ http protocol "https" {
          next if $host =~ /^(ipv4|ipv6)\./;
      -%>
      tls keypair <%= $host %>
-     <% unless (grep { $_ eq $host } @$f3s_hosts) { -%>
      tls keypair standby.<%= $host %>
      <% } -%>
-     <% } -%>
      tls keypair <%= $hostname.'.'.$domain -%>
 
      # Enable WebSocket support
diff --git a/frontends/scripts/acme.sh.tpl b/frontends/scripts/acme.sh.tpl
index 3b3b35f..dd613fc 100644
--- a/frontends/scripts/acme.sh.tpl
+++ b/frontends/scripts/acme.sh.tpl
@@ -16,6 +16,15 @@ ensure_placeholder_cert () {
     fi
 }
 
+alias_cert () {
+    source=$1
+    alias=$2
+
+    ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.crt"
+    ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.fullchain.pem"
+    ln -sf "/etc/ssl/private/$source.key" "/etc/ssl/private/$alias.key"
+}
+
 handle_cert () {
     host=$1
     host_ip=`host $host | awk '/has address/ { print $(NF) }'`
@@ -48,7 +57,13 @@ handle_cert <%= $host %>
 if [ $? -eq 0 ]; then
     has_update=yes
 fi
-<% unless ($host eq 'blowfish.buetow.org' or $host eq 'fishfinger.buetow.org') { -%>
+<% if (grep { $_ eq $host } @$f3s_hosts) { -%>
+# f3s standby names are SANs on the primary certificate. relayd selects a
+# keypair by SNI name, so provide filename aliases for that shared certificate.
+alias_cert <%= $host %> standby.<%= $host %>
+<% } -%>
+<% unless ($host eq 'blowfish.buetow.org' or $host eq 'fishfinger.buetow.org'
+           or grep { $_ eq $host } @$f3s_hosts) { -%>
 handle_cert standby.<%= $host %>
 if [ $? -eq 0 ]; then
     has_update=yes
-- 
cgit v1.2.3