From eabbcdaa2dd0965ff6a1ececdff7eff2cf09b733 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Tue, 7 Jul 2026 10:47:38 +0100
Subject: [PATCH] fix: request LE certs for all subdomains (app + dns) on
 greenfield

---
 deploy.sh | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/deploy.sh b/deploy.sh
index 9effb00..807d5ab 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -308,16 +308,20 @@ EOF
             curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
                 -d "set=${TLS_EMAIL}" > /dev/null
 
-            # Obtain certificate (30s timeout — can hang if DNS doesn't resolve)
-            echo "  Requesting LE certificate for app.${DOMAIN}..."
-            CERT_RESULT=$(curl -s --max-time 30 -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
-                -G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
-                -d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" 2>&1)
-            if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
-                echo "  [OK] Certificate obtained for app.${DOMAIN}"
-            else
-                echo "  [INFO] Certificate result: $CERT_RESULT (expected if DNS doesn't resolve yet)"
-            fi
+            # Obtain certificates for all subdomains (30s timeout each)
+            # URL-encode "Let's Encrypt" as Let%27s%20Encrypt to avoid curl parsing issues
+            LE_CA="Let%27s%20Encrypt"
+            for SUB in app dns; do
+                echo "  Requesting LE certificate for ${SUB}.${DOMAIN}..."
+                CERT_RESULT=$(curl -s --max-time 30 -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
+                    -G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
+                    -d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
+                if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
+                    echo "  [OK] Certificate obtained for ${SUB}.${DOMAIN}"
+                else
+                    echo "  [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
+                fi
+            done
 
             # Enable auto-renew
             echo "  Enabling auto-renew..."