From 93f853bd40da47cbb5e18ecc6995a1571bc3cc4b Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Tue, 7 Jul 2026 17:17:00 +0100
Subject: [PATCH] fix: 12-char password, cert upload API with CSRF retry

---
 deploy.sh  | 33 ++++++++++++++++++++++++++++-----
 install.sh |  4 ++--
 2 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/deploy.sh b/deploy.sh
index 7977dc3..49074a8 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -2,6 +2,7 @@
 set -euo pipefail
 
 REPO_DIR="/opt/NextWks"
+REPO_URL="https://git.lohmar.co.uk/lexton-it/NextWks.git"
 TARGET_DIR="/opt/nextworkspace"
 BACKUP_DIR="/opt/backup"
 SERVICE_NAME="nextworkspace"
@@ -36,11 +37,16 @@ else
     echo "[MODE] Smart update (target exists)"
 fi
 
-# --- Common: pull + build ---
+# --- Common: ensure repo exists, pull + build ---
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ ! -d "$REPO_DIR/.git" ]; then
+    echo "[1/6] Cloning repository..."
+    git clone "$REPO_URL" "$REPO_DIR"
+else
+    echo "[1/6] Pulling latest code..."
+    cd "$REPO_DIR" && git pull
+fi
 cd "$REPO_DIR"
-echo "[1/6] Pulling latest code..."
-git pull
 
 echo "[2/6] Building binary and helper tool..."
 export PATH=$PATH:/usr/local/go/bin
@@ -281,8 +287,25 @@ apps:
     icon: "admin"
 EOF
 
-    # All Zoraxy config (ACME, BoltDB) already written before Zoraxy started
-    echo "[*] Zoraxy configuration complete"
+    # Upload certs to Zoraxy via API (needed to register them in sys.db)
+    echo "[*] Registering certificates in Zoraxy..."
+    CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs"
+    for FQDN in app.${DOMAIN} dns.${DOMAIN} www.${DOMAIN}; do
+        CRT_FILE="$CERTS_DIR/${FQDN}.crt"
+        [ -f "$CRT_FILE" ] || continue
+        for TRY in 1 2 3 4 5; do
+            C=$(curl -s -c /tmp/zc.txt http://127.0.0.1:8000/login.html)
+            T=$(echo "$C" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
+            [ -z "$T" ] && sleep 2 && continue
+            R=$(curl -s -b /tmp/zc.txt -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \
+                -H "X-CSRF-Token: $T" --data-binary "@$CRT_FILE" 2>&1) || true
+            if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then
+                echo "  [OK] Cert registered: $FQDN"
+                break
+            fi
+            sleep 2
+        done
+    done
 
     # Write systemd service
     echo "[*] Writing systemd service..."
diff --git a/install.sh b/install.sh
index 53df949..e533d40 100755
--- a/install.sh
+++ b/install.sh
@@ -34,8 +34,8 @@ while [ -z "$ADMIN_USERNAME" ]; do
   read -p "Admin username (required): " ADMIN_USERNAME
 done
 
-# Generate random alphanumeric password (16 chars, easy to type)
-ADMIN_PASSWORD=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 16 2>/dev/null || echo "nextwks$(date +%s)")
+# Generate 12-char alphanumeric password (easy to type)
+ADMIN_PASSWORD=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 12 2>/dev/null || date +%s | head -c 12)
 
 echo ""
 echo "========================================"