fix: robust Zoraxy admin creation + LE automation with proper CSRF

deploy.sh

@@ -232,9 +232,8 @@ apps:
     icon: "admin"
 EOF
 
-    # Create Zoraxy admin account
+    # --- Configure Zoraxy admin + LE via API ---
-    echo "[*] Creating Zoraxy admin account..."
+    echo "[*] Configuring Zoraxy..."
-    ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"
 
     # Wait for Zoraxy to be ready
     for i in $(seq 1 15); do
@@ -244,46 +243,80 @@ EOF
         echo "  Waiting for Zoraxy... ($i/15)"
         sleep 2
     done
+    sleep 1
 
-    # Fetch CSRF token and create admin
+    # Helper: fetch CSRF token + cookie jar from Zoraxy login page
+    fetch_csrf() {
         COOKIE_JAR="/tmp/zoraxy_cookies.txt"
         rm -f "$COOKIE_JAR"
-    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
+        local page
-    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+        page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)
-    if [ -n "$CSRF_TOKEN" ]; then
+        local token
-        ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
+        token=$(echo "$page" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
-            -H "X-CSRF-Token: $CSRF_TOKEN" \
+        echo "$token"
+    }
+
+    # Step 1: Create admin account
+    echo "  Creating admin account..."
+    CSRF=$(fetch_csrf)
+    if [ -z "$CSRF" ]; then
+        echo "  [WARN] Could not fetch CSRF token — trying registration without it"
+        ADMIN_RESULT=$(curl -s -X POST "http://127.0.0.1:8000/api/auth/register" \
             -d "username=${ADMIN_USERNAME:-master}" \
             -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
-        if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
-            echo "[OK] Zoraxy admin account created"
     else
-            echo "[INFO] Admin API response: $ADMIN_CREATE"
+        ADMIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
-        fi
+            -H "X-CSRF-Token: $CSRF" \
-    fi
-
-    # Login to Zoraxy for LE config
-    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
-    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
-    if [ -n "$CSRF_TOKEN" ]; then
-        curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
-            -H "X-CSRF-Token: $CSRF_TOKEN" \
             -d "username=${ADMIN_USERNAME:-master}" \
-            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
+    fi
 
-        # Configure Let's Encrypt
+    if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
-        echo "[*] Setting Let's Encrypt email..."
+        echo "  [OK] Admin account created: $ADMIN_USERNAME"
+    elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
+        echo "  [OK] Admin account already exists"
+    else
+        echo "  [INFO] Admin registration response: $ADMIN_RESULT"
+    fi
+
+    # Step 2: Login with Zoraxy admin for LE configuration
+    echo "  Logging in for LE configuration..."
+    CSRF=$(fetch_csrf)
+    if [ -z "$CSRF" ]; then
+        echo "  [WARN] No CSRF token — skipping LE automation"
+    else
+        LOGIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
+            -H "X-CSRF-Token: $CSRF" \
+            -d "username=${ADMIN_USERNAME:-master}" \
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
+
+        if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
+            echo "  [OK] Logged in as $ADMIN_USERNAME"
+
+            # Set LE email
+            echo "  Setting Let's Encrypt email: ${TLS_EMAIL}"
             curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
                 -d "set=${TLS_EMAIL}" > /dev/null
 
-        echo "[*] Obtaining certificates for app.${DOMAIN}..."
+            # Obtain certificate
-        curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
+            echo "  Requesting LE certificate for app.${DOMAIN}..."
+            CERT_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
                 -G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
-            -d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" > /dev/null || true
+                -d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" 2>&1)
+            if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
+                echo "  [OK] Certificate obtained for app.${DOMAIN}"
+            else
+                echo "  [INFO] Certificate result: $CERT_RESULT (expected if DNS doesn't resolve yet)"
+            fi
 
-        echo "[*] Enabling auto-renew..."
+            # Enable auto-renew
+            echo "  Enabling auto-renew..."
             curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
                 -d "enable=true" > /dev/null
+            echo "  [OK] LE auto-renew enabled"
+        else
+            echo "  [WARN] Login failed: $LOGIN_RESULT"
+        fi
     fi
 
     # Restart Zoraxy to pick up configs