debug: add CSRF token debug output

deploy.sh

@@ -312,22 +312,28 @@ EOF
         FQDN="${SUB}.${DOMAIN}"
         CRT_FILE="$CERTS_DIR/${FQDN}.crt"
         [ -f "$CRT_FILE" ] || continue
+        # Three retries with fresh CSRF each time
         for TRY in 1 2 3; do
             rm -f /tmp/zc.txt
-            C=$(curl -s --max-time 5 -c /tmp/zc.txt "http://127.0.0.1:8000/login.html" 2>&1)
+            PAGE=$(curl -s --max-time 5 -c /tmp/zc.txt "http://127.0.0.1:8000/login.html" 2>&1)
-            T=$(echo "$C" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
+            TOKEN=$(echo "$PAGE" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
-            if [ -z "$T" ]; then
+            if [ -z "$TOKEN" ]; then
-                echo "  Retry $TRY for $FQDN (no CSRF)"
+                echo "  Retry $TRY for $FQDN (no CSRF token in page)"
                 sleep 2
                 continue
             fi
-            R=$(curl -s --max-time 5 -b /tmp/zc.txt -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \
+            echo "  Debug: token=${TOKEN:0:20}..."
-                -H "X-CSRF-Token: $T" --data-binary "@$CRT_FILE" 2>&1) || true
+            R=$(curl -s --max-time 5 -b /tmp/zc.txt -X POST \
+                -H "X-CSRF-Token: $TOKEN" \
+                -H "Referer: http://127.0.0.1:8000/login.html" \
+                -H "Origin: http://127.0.0.1:8000" \
+                "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \
+                --data-binary "@$CRT_FILE" 2>&1) || true
             if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then
                 echo "  [OK] Cert registered: $FQDN"
                 break
             else
-                echo "  Retry $TRY for $FQDN: $(echo $R | head -c 80)"
+                echo "  Retry $TRY for $FQDN: $(echo $R | head -c 100)"
                 sleep 2
             fi
         done