Auto-delete server certs on config upgrade to force re-signing

Add migrate_config_if_needed() that checks the config version marker,
backs up the old config, writes the new default, and deletes the
server cert + key so the next setup/start re-signs with the updated
certificate_domains (now including idcflare.com).

Called from init_config, setup, prepare_certificate, run_foreground,
and helper_start — every entry point that touches ensure_bundle.

Author: fjh1997

src/certs.rs

@@ -26,6 +26,18 @@ pub fn ensure_bundle(config: &AppConfig, root: &Path) -> Result<CertificateBundl
     generate_bundle(config, root, false)
 }
 
+pub fn clear_server_certs(root: &Path) {
+    for name in [
+        "linuxdo-accelerator-server.crt",
+        "linuxdo-accelerator-server.key",
+    ] {
+        let path = root.join(name);
+        if path.exists() {
+            let _ = fs::remove_file(&path);
+        }
+    }
+}
+
 pub fn load_or_create_bundle(config: &AppConfig, root: &Path) -> Result<CertificateBundle> {
     generate_bundle(config, root, false)
 }

src/config.rs

@@ -167,6 +167,33 @@ fn marker_matches_current_version(marker_path: &Path) -> bool {
 }
 
 impl AppConfig {
+    pub fn migrate_config_if_needed(path: &Path, cert_dir: &Path) -> Result<bool> {
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent)
+                .with_context(|| format!("failed to create {}", parent.display()))?;
+        }
+
+        let marker_path = version_marker_path(path);
+        if path.exists() && marker_matches_current_version(&marker_path) {
+            return Ok(false);
+        }
+
+        let backup_path = backup_config_path(path);
+        fs::copy(path, &backup_path).with_context(|| {
+            format!(
+                "failed to back up {} to {}",
+                path.display(),
+                backup_path.display()
+            )
+        })?;
+        fs::write(path, DEFAULT_APP_CONFIG)
+            .with_context(|| format!("failed to write config {}", path.display()))?;
+        write_version_marker(&marker_path)?;
+        crate::certs::clear_server_certs(cert_dir);
+        cleanup_legacy_network_profile(path)?;
+        Ok(true)
+    }
+
     pub fn load_or_create(path: &Path) -> Result<Self> {
         if let Some(parent) = path.parent() {
             fs::create_dir_all(parent)

src/service.rs

@@ -35,6 +35,7 @@ pub fn resolve_paths(config_override: Option<PathBuf>) -> Result<AppPaths> {
 
 pub fn init_config(config_path: Option<PathBuf>) -> Result<PathBuf> {
     let paths = resolve_paths(config_path)?;
+    let _ = AppConfig::migrate_config_if_needed(&paths.config_path, &paths.cert_dir)?;
     let _ = AppConfig::load_or_create(&paths.config_path)?;
     Ok(paths.config_path)
 }
@@ -43,6 +44,7 @@ pub fn setup(config_path: Option<PathBuf>) -> Result<()> {
     let paths = resolve_paths(config_path)?;
     log_info(&paths, "setup", "开始准备系统加速环境");
     let result = (|| -> Result<()> {
+        let _ = AppConfig::migrate_config_if_needed(&paths.config_path, &paths.cert_dir)?;
         let config = AppConfig::load_or_create(&paths.config_path)?;
         ensure_elevated(&config, true)?;
         ensure_loopback_alias(&config)?;
@@ -64,6 +66,7 @@ pub fn prepare_certificate(config_path: Option<PathBuf>) -> Result<()> {
     let paths = resolve_paths(config_path)?;
     log_info(&paths, "prepare-cert", "开始准备根证书");
     let result = (|| -> Result<()> {
+        let _ = AppConfig::migrate_config_if_needed(&paths.config_path, &paths.cert_dir)?;
         let config = AppConfig::load_or_create(&paths.config_path)?;
         let bundle = ensure_bundle(&config, &paths.cert_dir)?;
         install_ca(&bundle.ca_cert_path, &config.ca_common_name)?;
@@ -87,6 +90,7 @@ pub async fn run_foreground(config_path: Option<PathBuf>, with_setup: bool) -> R
             "守护进程启动：直接进入前台代理"
         },
     );
+    let _ = AppConfig::migrate_config_if_needed(&paths.config_path, &paths.cert_dir)?;
     let config = AppConfig::load_or_create(&paths.config_path)?;
     ensure_elevated(&config, with_setup)?;
     ensure_loopback_alias(&config)?;
@@ -135,6 +139,7 @@ pub async fn run_foreground(config_path: Option<PathBuf>, with_setup: bool) -> R
 pub fn helper_start(config_path: Option<PathBuf>) -> Result<()> {
     let paths = resolve_paths(config_path)?;
     log_info(&paths, "helper-start", "收到启动请求，开始准备加速环境");
+    let _ = AppConfig::migrate_config_if_needed(&paths.config_path, &paths.cert_dir)?;
     let config = AppConfig::load_or_create(&paths.config_path)?;
     let start_result = (|| -> Result<()> {
         ensure_elevated(&config, true)?;