Merge pull request #33 from coderbuzz/feat/cf-proxied-during-cert

fix: create CF DNS record with proxied=false first for Caddy cert issuance

Author: coderbuzz

internal/app/repository.go

@@ -349,6 +349,15 @@ func (r *Repository) SaveDNSRecord(appID, serverID int64, zoneID, recordID, name
 	return err
 }
 
+func (r *Repository) UpdateDNSRecordProxied(recordID string, proxied bool) error {
+	proxiedInt := 0
+	if proxied {
+		proxiedInt = 1
+	}
+	_, err := r.db.Exec(`UPDATE dns_records SET proxied = ? WHERE record_id = ?`, proxiedInt, recordID)
+	return err
+}
+
 func (r *Repository) GetDNSRecords(appID int64) ([]DNSRecordInfo, error) {
 	rows, err := r.db.Query(`
 		SELECT id, app_id, server_id, zone_id, record_id, name, type, content, proxied, created_at

internal/app/service.go

@@ -392,15 +392,38 @@ func (s *Service) setupRouteAndDNSForDomain(route Route, app *App, svr *server.S
 				log.Printf("DNS A record already exists for %s, IP matches (IP: %s, proxied: %v)", route.Domain, existing.Content, existing.Proxied)
 			}
 		} else {
-			record, err := s.cf.CreateRecord(route.Domain, svr.Host, true)
+			record, err := s.cf.CreateRecord(route.Domain, svr.Host, false)
 			if err != nil {
 				log.Printf("Warning: Cloudflare DNS failed for %s: %v", route.Domain, err)
 				if logs != nil {
 					*logs = append(*logs, fmt.Sprintf("dns/%s: %v", route.Domain, err))
 				}
 			} else {
-				log.Printf("DNS A record created: %s -> %s", record.Name, record.Content)
+				log.Printf("DNS A record created: %s -> %s (proxied=false)", record.Name, record.Content)
 				s.repo.SaveDNSRecord(app.ID, svr.ID, record.ZoneID, record.ID, record.Name, "A", record.Content, record.Proxied)
+
+				caddyClient := caddy.NewClient(client)
+				if caddyClient.WaitForCertificate(route.Domain, 60*time.Second) {
+					updated, err := s.cf.UpdateRecord(record.ID, route.Domain, svr.Host, true)
+					if err != nil {
+						log.Printf("Warning: failed to enable Cloudflare proxy for %s: %v", route.Domain, err)
+						if logs != nil {
+							*logs = append(*logs, fmt.Sprintf("dns/%s: enable proxy failed: %v", route.Domain, err))
+						}
+					} else {
+						log.Printf("Cloudflare proxy enabled for %s", route.Domain)
+						s.repo.UpdateDNSRecordProxied(record.ID, true)
+						if logs != nil {
+							*logs = append(*logs, fmt.Sprintf("dns/%s: proxy enabled (cert ok)", route.Domain))
+						}
+						_ = updated
+					}
+				} else {
+					log.Printf("Timeout waiting for Caddy cert for %s, leaving proxied=false", route.Domain)
+					if logs != nil {
+						*logs = append(*logs, fmt.Sprintf("dns/%s: timeout, proxy disabled", route.Domain))
+					}
+				}
 			}
 		}
 	}

internal/caddy/client.go

@@ -3,7 +3,9 @@ package caddy
 import (
 	"encoding/json"
 	"fmt"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/coderbuzz/dockify/internal/ssh"
 	"golang.org/x/crypto/bcrypt"
@@ -143,6 +145,41 @@ func (c *Client) RemoveRoute(domain string) error {
 	return nil
 }
 
+// CheckCertificate checks whether Caddy has obtained a valid TLS certificate
+// for the given domain by performing a TLS handshake via localhost.
+func (c *Client) CheckCertificate(domain string) (bool, error) {
+	cmd := fmt.Sprintf(
+		`docker exec caddy curl -sI -o /dev/null -w '%%{http_code}' --connect-timeout 5 --resolve %s:443:127.0.0.1 https://%s/ 2>&1`,
+		domain, domain,
+	)
+	out, err := c.ssh.Exec(cmd)
+	if err != nil {
+		return false, nil
+	}
+	code := strings.TrimSpace(out)
+	if code == "" || code == "000" {
+		return false, nil
+	}
+	n, err := strconv.Atoi(code)
+	if err != nil || n == 0 {
+		return false, nil
+	}
+	return true, nil
+}
+
+// WaitForCertificate polls CheckCertificate until the cert is ready or timeout.
+func (c *Client) WaitForCertificate(domain string, timeout time.Duration) bool {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		ready, err := c.CheckCertificate(domain)
+		if err == nil && ready {
+			return true
+		}
+		time.Sleep(2 * time.Second)
+	}
+	return false
+}
+
 func sanitizeID(s string) string {
 	r := strings.NewReplacer(".", "-", "*", "-")
 	return "dockify-" + r.Replace(s)