From efaa91701308eb7281481182d11ee8bff4941ba2 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Tue, 7 Jul 2026 18:20:21 +0100
Subject: [PATCH] feat: LE_DRY_RUN=true skips LE, generates self-signed

---
 deploy.sh                  | 4 +++-
 tools/nextwks-tool/main.go | 6 ++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/deploy.sh b/deploy.sh
index 258a1bf..92689c8 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -104,10 +104,12 @@ if [ "$GREENFIELD" = true ]; then
     echo "[4/6] Checking certificates..."
     mkdir -p "$BACKUP_DIR/certificates"
     if [ -f "$TOOL_BIN" ]; then
+        DRY=""
+        [ "${LE_DRY_RUN:-false}" = "true" ] && DRY="--dry-run"
         "$TOOL_BIN" cert \
             --domains "${APP_SUB}.${DOMAIN},${DNS_SUB}.${DOMAIN},${WWW_SUB}.${DOMAIN}" \
             --email "${TLS_EMAIL:-admin@${DOMAIN}}" \
-            --backup-dir "$BACKUP_DIR/certificates" 2>&1 || true
+            --backup-dir "$BACKUP_DIR/certificates" $DRY 2>&1 || true
     fi
 
     # Step 5: Build production directory structure
diff --git a/tools/nextwks-tool/main.go b/tools/nextwks-tool/main.go
index 423c9f1..6434c1f 100644
--- a/tools/nextwks-tool/main.go
+++ b/tools/nextwks-tool/main.go
@@ -99,6 +99,7 @@ func runCert(args []string) {
 	email := fs.String("email", "", "ACME email")
 	backupDir := fs.String("backup-dir", "/opt/backup/certificates", "Backup directory for certs")
 	legoDir := fs.String("lego-dir", "/opt/backup", "Lego working directory")
+	dryRun := fs.Bool("dry-run", false, "Skip LE, generate self-signed if no backup")
 	fs.Parse(args)
 
 	if *domainsStr == "" || *email == "" {
@@ -135,6 +136,11 @@ func runCert(args []string) {
 	}
 
 	if needIssue {
+		if *dryRun {
+			log.Printf("[INFO] Dry-run mode — generating self-signed fallback certs")
+			generateSelfSigned(domains, *backupDir)
+			return
+		}
 		// Try lego first
 		legoPath, legoErr := exec.LookPath("lego")
 		if legoErr == nil {