Sandbox domain NGINX config and certificate issues

[tituspijean]

On a fresh install on YunoHost 13 (testing):

• the sandbox NGINX assumes SSL is running through port 443, which is not the case if TLS passthrough is enabled on the YunoHost server. In that case, the app shows a "Welcome to NGINX!" page instead of Cryptpad initially, then NGINX will fail upon any service restart.
• the sandbox NGINX config still includes the OCSP settings, which does not exist anymore in the usual YunoHost NGINX templates
• the sandbox NGINX config is not correctly handled by the regen-conf. It wants to delete it if one does yunohost tools regen-conf nginx -dn
• Even after following the DNS and certificate renewal instructions, the sandbox domain is not included in the main pad domain certificate's Subject Alt Names.

[tituspijean]

Even after following the DNS and certificate renewal instructions, the sandbox domain is not included in the main pad domain certificate's Subject Alt Names.

This is caused by https://github.com/YunoHost/yunohost/blob/4ea070260569c0f2d009e2603256693a0cbfdf48/src/certificate.py#L620: the sanlist gets emptied because it only contains one element that has a dot in it. The upstream code tries to readd the other elements without dots, but the list is already emptied.

This is fixed in both dev and trixie branch... somehow my server's code is not up to date.

[Josue-T]

Juste some note, the current state of handling the sandbox domain is really not perfect. In my opinion we would really need an official api for this managed by the core. This way we should be able to avoid any bug like this.

Started doing something here: YunoHost/yunohost#2099

[Josue-T]

the sandbox NGINX config still includes the OCSP settings, which does not exist anymore in the usual YunoHost NGINX templates

We would probably need to synchronize the sandbox domain config from upstream

the sandbox NGINX assumes SSL is running through port 443, which is not the case if TLS passthrough is enabled on the YunoHost server. In that case, the app shows a "Welcome to NGINX!" page instead of Cryptpad initially, then

So if I understand correctly this not working only on the case of TLS pass through ?

[tituspijean]

We would probably need to synchronize the sandbox domain config from upstream
So if I understand correctly this not working only on the case of TLS pass through ?

I am wondering if there's a way to call the file template directly from YunoHost. That would be cleaner, I think.
But the cleanest way is your addition domain resource.