feat: LE_DRY_RUN=true skips LE, generates self-signed

deploy.sh

@@ -104,10 +104,12 @@ if [ "$GREENFIELD" = true ]; then
     echo "[4/6] Checking certificates..."
     mkdir -p "$BACKUP_DIR/certificates"
     if [ -f "$TOOL_BIN" ]; then
+        DRY=""
+        [ "${LE_DRY_RUN:-false}" = "true" ] && DRY="--dry-run"
         "$TOOL_BIN" cert \
             --domains "${APP_SUB}.${DOMAIN},${DNS_SUB}.${DOMAIN},${WWW_SUB}.${DOMAIN}" \
             --email "${TLS_EMAIL:-admin@${DOMAIN}}" \
-            --backup-dir "$BACKUP_DIR/certificates" 2>&1 || true
+            --backup-dir "$BACKUP_DIR/certificates" $DRY 2>&1 || true
     fi
 
     # Step 5: Build production directory structure

tools/nextwks-tool/main.go

@@ -99,6 +99,7 @@ func runCert(args []string) {
 	email := fs.String("email", "", "ACME email")
 	backupDir := fs.String("backup-dir", "/opt/backup/certificates", "Backup directory for certs")
 	legoDir := fs.String("lego-dir", "/opt/backup", "Lego working directory")
+	dryRun := fs.Bool("dry-run", false, "Skip LE, generate self-signed if no backup")
 	fs.Parse(args)
 
 	if *domainsStr == "" || *email == "" {
@@ -135,6 +136,11 @@ func runCert(args []string) {
 	}
 
 	if needIssue {
+		if *dryRun {
+			log.Printf("[INFO] Dry-run mode — generating self-signed fallback certs")
+			generateSelfSigned(domains, *backupDir)
+			return
+		}
 		// Try lego first
 		legoPath, legoErr := exec.LookPath("lego")
 		if legoErr == nil {