fix: preserve PK01 Caddy managed blocks

scripts/src/platform-infra.ts

@@ -5,6 +5,7 @@ import type { UniDeskConfig } from "./config";
 import { rootPath } from "./config";
 import { startJob } from "./jobs";
 import type { RenderedCliResult } from "./output";
+import { pk01CaddyMergeManagedBlocksPython, renderCaddyManagedBlock, renderSimpleReverseProxyCaddySiteBlock } from "./pk01-caddy";
 import { runSshCommandCapture, type SshCaptureResult } from "./ssh";
 
 const defaultTargetId = "D601";
@@ -16,6 +17,7 @@ const configPath = rootPath("config", "platform-infra", "sub2api.yaml");
 const codexPoolConfigPath = rootPath("config", "platform-infra", "sub2api-codex-pool.yaml");
 const repoRoot = rootPath();
 const secretName = "sub2api-secrets";
+const sub2apiCaddyManagedMarker = "sub2api";
 const requiredSecretKeys = ["POSTGRES_PASSWORD", "ADMIN_PASSWORD", "JWT_SECRET", "TOTP_ENCRYPTION_KEY"] as const;
 
 type DatabaseMode = "bundled" | "external-pending" | "external-active";
@@ -2448,8 +2450,15 @@ fi
 install_rc=1
 if [ "$download_rc" -eq 0 ]; then
   sudo mkdir -p "$(dirname ${shQuote(exposure.pk01.caddyConfigPath)})" ${shQuote(exposure.pk01.caddyStorageDir)} /etc/systemd/system
-  sudo install -m 0644 "$caddyfile" ${shQuote(exposure.pk01.caddyConfigPath)} >"$install_out" 2>"$install_err"
+  merged_caddyfile="$tmp/Caddyfile.merged"
+  sudo python3 - "$caddyfile" ${shQuote(exposure.pk01.caddyConfigPath)} "$merged_caddyfile" ${shQuote(exposure.dns.hostname)} >"$install_out" 2>"$install_err" <<'PY'
+${pk01CaddyMergeManagedBlocksPython()}
+PY
   install_rc=$?
+  if [ "$install_rc" -eq 0 ]; then
+    sudo install -m 0644 "$merged_caddyfile" ${shQuote(exposure.pk01.caddyConfigPath)} >>"$install_out" 2>>"$install_err"
+    install_rc=$?
+  fi
   if [ "$install_rc" -eq 0 ]; then
     sudo install -m 0644 "$service_unit" /etc/systemd/system/${exposure.pk01.caddyServiceName}.service >>"$install_out" 2>>"$install_err"
     install_rc=$?
@@ -2582,6 +2591,14 @@ PY
 
 function renderPk01Caddyfile(exposure: Sub2ApiPublicExposureConfig): string {
   const apexHost = baseDomain(exposure.dns.hostname);
+  const apiBlock = renderCaddyManagedBlock(
+    sub2apiCaddyManagedMarker,
+    renderSimpleReverseProxyCaddySiteBlock({
+      hostname: exposure.dns.hostname,
+      upstream: `127.0.0.1:${exposure.frpc.remotePort}`,
+      responseHeaderTimeoutSeconds: exposure.pk01.responseHeaderTimeoutSeconds,
+    }),
+  );
   return `{
   email ${exposure.pk01.caddyEmail}
   storage file_system {
@@ -2593,13 +2610,7 @@ ${apexHost}, www.${apexHost} {
   reverse_proxy 127.0.0.1:${exposure.pk01.pikanodeHttpHostPort}
 }
 
-${exposure.dns.hostname} {
-  reverse_proxy 127.0.0.1:${exposure.frpc.remotePort} {
-    transport http {
-      response_header_timeout ${exposure.pk01.responseHeaderTimeoutSeconds}s
-    }
-  }
-}
+${apiBlock.trim()}
 `;
 }