Fix daemon regenerating certs and breaking trust store CA match

load_or_create_bundle was identical to ensure_bundle — both called
generate_bundle, so the daemon process regenerated CA+server certs
after helper_start already installed the original CA to the trust
store. The mismatch caused ERR_CERT_AUTHORITY_INVALID in browsers.

Refactor: split into ensure_bundle (generates, used by setup paths)
and load_bundle (read-only, used by daemon). Extract bundle_paths
to deduplicate path construction.

Author: fjh1997

src/certs.rs

@@ -4,7 +4,7 @@ use std::hash::{Hash, Hasher};
 use std::io::ErrorKind;
 use std::path::{Path, PathBuf};
 
-use anyhow::{Context, Result, anyhow};
+use anyhow::{Context, Result, anyhow, bail};
 use rcgen::{
     BasicConstraints, Certificate, CertificateParams, DistinguishedName, DnType,
     ExtendedKeyUsagePurpose, IsCa, KeyUsagePurpose,
@@ -28,20 +28,31 @@ pub fn ensure_bundle(config: &AppConfig, root: &Path) -> Result<CertificateBundl
     generate_bundle(config, root)
 }
 
-pub fn load_or_create_bundle(config: &AppConfig, root: &Path) -> Result<CertificateBundle> {
-    generate_bundle(config, root)
+pub fn load_bundle(root: &Path) -> Result<CertificateBundle> {
+    let bundle = bundle_paths(root);
+    if !bundle_all_exist(&bundle) {
+        bail!(
+            "certificate files not found in {}; run setup first",
+            root.display()
+        );
+    }
+    Ok(bundle)
+}
+
+fn bundle_paths(root: &Path) -> CertificateBundle {
+    CertificateBundle {
+        ca_cert_path: root.join("linuxdo-accelerator-root-ca.crt"),
+        server_cert_path: root.join("linuxdo-accelerator-server.crt"),
+        server_key_path: root.join("linuxdo-accelerator-server.key"),
+    }
 }
 
 fn generate_bundle(config: &AppConfig, root: &Path) -> Result<CertificateBundle> {
     let cert_dir = root.to_path_buf();
     fs::create_dir_all(&cert_dir)
         .with_context(|| format!("failed to create {}", cert_dir.display()))?;
 
-    let bundle = CertificateBundle {
-        ca_cert_path: cert_dir.join("linuxdo-accelerator-root-ca.crt"),
-        server_cert_path: cert_dir.join("linuxdo-accelerator-server.crt"),
-        server_key_path: cert_dir.join("linuxdo-accelerator-server.key"),
-    };
+    let bundle = bundle_paths(&cert_dir);
 
     let domains_hash_path = cert_dir.join("linuxdo-accelerator-domains.sha256");
     let current_hash = domains_hash(&config.certificate_domains);

src/service.rs

@@ -10,7 +10,7 @@ use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 use anyhow::{Result, bail};
 use tokio::sync::watch;
 
-use crate::certs::{ensure_bundle, load_or_create_bundle};
+use crate::certs::{ensure_bundle, load_bundle};
 use crate::config::AppConfig;
 use crate::hosts::{
     apply_hosts, backup_hosts_file, remove_hosts, restore_hosts_file,
@@ -97,7 +97,7 @@ pub async fn run_foreground(config_path: Option<PathBuf>, with_setup: bool) -> R
     let bundle = if with_setup {
         ensure_bundle(&config, &paths.cert_dir)?
     } else {
-        load_or_create_bundle(&config, &paths.cert_dir)?
+        load_bundle(&paths.cert_dir)?
     };
     if with_setup {
         install_ca(&bundle.ca_cert_path, &config.ca_common_name)?;