From 83661641559b92d9f6e3e7983478d1d45bffa7a7 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Tue, 7 Jul 2026 09:13:07 +0100
Subject: [PATCH] fix: restore dns config, Zoraxy admin, LE automation

---
 .../zoraxy/conf/proxy/dns.nextwks.eu.config   | 12 +++
 deploy.sh                                     | 81 +++++++++++++++++--
 2 files changed, 87 insertions(+), 6 deletions(-)
 create mode 100644 config/zoraxy/conf/proxy/dns.nextwks.eu.config

diff --git a/config/zoraxy/conf/proxy/dns.nextwks.eu.config b/config/zoraxy/conf/proxy/dns.nextwks.eu.config
new file mode 100644
index 0000000..bbfae44
--- /dev/null
+++ b/config/zoraxy/conf/proxy/dns.nextwks.eu.config
@@ -0,0 +1,12 @@
+{
+    "ProxyType": 1,
+    "RootOrMatchingDomain": "dns.nextwks.eu",
+    "ActiveOrigins": [{
+        "OriginIpOrDomain": "127.0.0.1:8000",
+        "RequireTLS": false,
+        "Weight": 1,
+        "MaxConn": 0
+    }],
+    "Disabled": false,
+    "AuthenticationProvider": {"AuthMethod": 0}
+}
diff --git a/deploy.sh b/deploy.sh
index 2c0b1b0..d838c1e 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -59,9 +59,9 @@ if [ "$GREENFIELD" = true ]; then
     cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
     podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues (see above)"
 
-    # Generate Zoraxy proxy config (single app.{domain} → binary, auth handled by binary)
-    echo "[*] Generating Zoraxy proxy config..."
-    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_CFG
+    # Generate Zoraxy proxy configs (both app and dns, AuthMethod 0 — binary handles auth for app)
+    echo "[*] Generating Zoraxy proxy configs..."
+    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
 {
     "ProxyType": 1,
     "RootOrMatchingDomain": "app.$DOMAIN",
@@ -74,7 +74,22 @@ if [ "$GREENFIELD" = true ]; then
     "Disabled": false,
     "AuthenticationProvider": {"AuthMethod": 0}
 }
-ZORAXY_CFG
+ZORAXY_APP
+
+    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/dns.$DOMAIN.config" <<ZORAXY_DNS
+{
+    "ProxyType": 1,
+    "RootOrMatchingDomain": "dns.$DOMAIN",
+    "ActiveOrigins": [{
+        "OriginIpOrDomain": "127.0.0.1:8000",
+        "RequireTLS": false,
+        "Weight": 1,
+        "MaxConn": 0
+    }],
+    "Disabled": false,
+    "AuthenticationProvider": {"AuthMethod": 0}
+}
+ZORAXY_DNS
 
     # Copy launcher config files
     cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"
@@ -125,8 +140,62 @@ apps:
     icon: "admin"
 EOF
 
-    # Restart Zoraxy to pick up config
-    echo "[*] Restarting Zoraxy to apply config..."
+    # Create Zoraxy admin account
+    echo "[*] Creating Zoraxy admin account..."
+    ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"
+
+    # Wait for Zoraxy to be ready
+    for i in $(seq 1 15); do
+        if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
+            break
+        fi
+        echo "  Waiting for Zoraxy... ($i/15)"
+        sleep 2
+    done
+
+    # Fetch CSRF token and create admin
+    COOKIE_JAR="/tmp/zoraxy_cookies.txt"
+    rm -f "$COOKIE_JAR"
+    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
+    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+    if [ -n "$CSRF_TOKEN" ]; then
+        ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
+            -H "X-CSRF-Token: $CSRF_TOKEN" \
+            -d "username=${ADMIN_USERNAME:-master}" \
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
+        if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
+            echo "[OK] Zoraxy admin account created"
+        else
+            echo "[INFO] Admin API response: $ADMIN_CREATE"
+        fi
+    fi
+
+    # Login to Zoraxy for LE config
+    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
+    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+    if [ -n "$CSRF_TOKEN" ]; then
+        curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
+            -H "X-CSRF-Token: $CSRF_TOKEN" \
+            -d "username=${ADMIN_USERNAME:-master}" \
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null
+
+        # Configure Let's Encrypt
+        echo "[*] Setting Let's Encrypt email..."
+        curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
+            -d "set=${TLS_EMAIL}" > /dev/null
+
+        echo "[*] Obtaining certificates for app.${DOMAIN}..."
+        curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
+            -G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
+            -d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" > /dev/null || true
+
+        echo "[*] Enabling auto-renew..."
+        curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
+            -d "enable=true" > /dev/null
+    fi
+
+    # Restart Zoraxy to pick up configs
+    echo "[*] Restarting Zoraxy to apply configs..."
     podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
     sleep 2