fix(nginx): preserve SSL config across domain updates and restarts

writeAndReload() was regenerating nginx configs from a template that
only supported HTTP (port 80), overwriting certbot's SSL directives.
Now the template conditionally generates full SSL blocks when
SSLEnabled=true. SyncConfigs() verifies certificate presence on disk
at startup and syncs the SSLEnabled flag accordingly. Added UI button
to renew certificates for domains that already have SSL.

Author: Fokir

internal/nginx/service.go

@@ -40,6 +40,24 @@ func (s *Service) SyncConfigs() error {
 	for i := range domains {
 		d := &domains[i]
 
+		// Sync SSL flag with actual certificate presence on disk
+		if runtime.GOOS == "linux" {
+			certExists := s.sslCertExists(d.Domain)
+			if certExists && !d.SSLEnabled {
+				slog.Info("SSL certificate found on disk, enabling SSL flag", "domain", d.Domain)
+				d.SSLEnabled = true
+				if err := s.repo.Update(d); err != nil {
+					slog.Error("failed to update SSL flag", "error", err, "domain", d.Domain)
+				}
+			} else if !certExists && d.SSLEnabled {
+				slog.Warn("SSL certificate missing on disk, disabling SSL flag", "domain", d.Domain)
+				d.SSLEnabled = false
+				if err := s.repo.Update(d); err != nil {
+					slog.Error("failed to update SSL flag", "error", err, "domain", d.Domain)
+				}
+			}
+		}
+
 		// Migrate: generate missing cookie secret for auth-enabled domains
 		if d.AuthEnabled && d.AuthCookieSecret == "" {
 			secret, err := generateCookieSecret()
@@ -338,7 +356,28 @@ func (s *Service) RequestSSL(id int64, email string) error {
 	}
 
 	domain.SSLEnabled = true
-	return s.repo.Update(domain)
+	if err := s.repo.Update(domain); err != nil {
+		return fmt.Errorf("update domain: %w", err)
+	}
+
+	// Regenerate config with SSL directives from our template
+	if err := s.writeAndReload(domain); err != nil {
+		slog.Error("failed to regenerate nginx config after SSL", "error", err, "domain", domain.Domain)
+	}
+
+	return nil
+}
+
+func (s *Service) sslCertExists(domain string) bool {
+	certPath := fmt.Sprintf("/etc/letsencrypt/live/%s/fullchain.pem", domain)
+	keyPath := fmt.Sprintf("/etc/letsencrypt/live/%s/privkey.pem", domain)
+	if _, err := os.Stat(certPath); err != nil {
+		return false
+	}
+	if _, err := os.Stat(keyPath); err != nil {
+		return false
+	}
+	return true
 }
 
 func (s *Service) configPath(domain string) string {

internal/nginx/template.go

@@ -5,11 +5,8 @@ import (
 	"text/template"
 )
 
-const nginxConfTemplate = `# Managed by system-control. Do not edit manually.
-server {
-    listen 80;
-    server_name {{.Domain}};
-
+// locationBlock is a reusable sub-template for proxy location directives.
+const locationBlock = `
 {{- if .HasAuth}}
     # Cookie-based auth via system-control
     location = /_sc_auth_verify {
@@ -58,11 +55,39 @@ server {
     location @login_redirect {
         return 302 $scheme://$host/_sc_auth/login?domain=$host&redirect=$scheme://$host$request_uri;
     }
-{{- end}}
+{{- end}}`
+
+const nginxConfTemplate = `# Managed by system-control. Do not edit manually.
+{{- if .SSLEnabled}}
+server {
+    listen 80;
+    server_name {{.Domain}};
+    return 301 https://$host$request_uri;
 }
+
+server {
+    listen 443 ssl;
+    server_name {{.Domain}};
+
+    ssl_certificate /etc/letsencrypt/live/{{.Domain}}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{.Domain}}/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+{{template "locations" .}}
+}
+{{- else}}
+server {
+    listen 80;
+    server_name {{.Domain}};
+{{template "locations" .}}
+}
+{{- end}}
 `
 
-var confTmpl = template.Must(template.New("nginx").Parse(nginxConfTemplate))
+var confTmpl = template.Must(
+	template.Must(template.New("locations").Parse(locationBlock)).
+		New("nginx").Parse(nginxConfTemplate),
+)
 
 type configData struct {
 	Domain            string
@@ -72,6 +97,7 @@ type configData struct {
 	UpstreamSSLVerify bool
 	HasAuth           bool
 	BackendPort       int
+	SSLEnabled        bool
 }
 
 func renderConfig(d *Domain, backendPort int) ([]byte, error) {
@@ -87,6 +113,7 @@ func renderConfig(d *Domain, backendPort int) ([]byte, error) {
 		UpstreamSSLVerify: d.UpstreamSSLVerify,
 		HasAuth:           d.AuthEnabled,
 		BackendPort:       backendPort,
+		SSLEnabled:        d.SSLEnabled,
 	}
 	var buf bytes.Buffer
 	if err := confTmpl.Execute(&buf, data); err != nil {

web/src/pages/NginxDomainsPage.tsx

@@ -1,6 +1,6 @@
 import { useState } from 'react'
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query'
-import { Plus, Trash2, Shield, ShieldOff, Lock, Download, ExternalLink, Pencil, Palette } from 'lucide-react'
+import { Plus, Trash2, Shield, ShieldOff, Lock, Download, ExternalLink, Pencil, Palette, RefreshCw } from 'lucide-react'
 import { api } from '../api/client'
 import type { NginxDomain, ExternalNginxDomain, NetworkNode } from '../types'
 import { Button } from '../components/ui/Button'
@@ -215,7 +215,16 @@ export function NginxDomainsPage() {
                 <div>
                   <span className="text-slate-500">SSL</span>
                   {d.sslEnabled ? (
-                    <p className="text-green-400 flex items-center gap-1"><Shield size={14} /> Active</p>
+                    <div className="flex items-center gap-2">
+                      <p className="text-green-400 flex items-center gap-1"><Shield size={14} /> Active</p>
+                      <button
+                        onClick={() => setSslDomainId(d.id)}
+                        className="text-slate-500 hover:text-yellow-400 transition-colors"
+                        title="Renew certificate"
+                      >
+                        <RefreshCw size={14} />
+                      </button>
+                    </div>
                   ) : (
                     <button
                       onClick={() => setSslDomainId(d.id)}