Add website API docs, SSL api-hosts, and git-only deploy workflow.

Serve public storefront docs at /docs/website, expose api.{domain} hosts for API SSL sync, and require push-then-pull deploys instead of rsync.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/internal-ssl/internal-ssl.controller.ts

@@ -0,0 +1,21 @@
+import { Controller, Get, UseGuards } from '@nestjs/common';
+import { InternalSslService } from './internal-ssl.service';
+import { SslSyncTokenGuard } from './ssl-sync-token.guard';
+
+@Controller('internal/ssl')
+@UseGuards(SslSyncTokenGuard)
+export class InternalSslController {
+  constructor(private readonly service: InternalSslService) {}
+
+  /** Dashboards VPS cert sync: active apex → business./customer. hosts + admin. */
+  @Get('hosts')
+  listHosts() {
+    return this.service.listDashboardHosts();
+  }
+
+  /** API VPS cert sync: central api host + api.{apex} per active domain. */
+  @Get('api-hosts')
+  listApiHosts() {
+    return this.service.listApiHosts();
+  }
+}

src/internal-ssl/internal-ssl.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { InternalSslController } from './internal-ssl.controller';
+import { InternalSslService } from './internal-ssl.service';
+import { SslSyncTokenGuard } from './ssl-sync-token.guard';
+
+@Module({
+  controllers: [InternalSslController],
+  providers: [InternalSslService, SslSyncTokenGuard],
+})
+export class InternalSslModule {}

src/internal-ssl/internal-ssl.service.ts

@@ -0,0 +1,56 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '../prisma/prisma.service';
+
+@Injectable()
+export class InternalSslService {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly config: ConfigService,
+  ) {}
+
+  private async listActiveApexHosts(): Promise<string[]> {
+    const domains = await this.prisma.domain.findMany({
+      where: { isActive: true },
+      select: { host: true },
+      orderBy: { host: 'asc' },
+    });
+
+    const hosts: string[] = [];
+    for (const { host } of domains) {
+      const apex = host.trim().toLowerCase();
+      if (apex) hosts.push(apex);
+    }
+    return hosts;
+  }
+
+  /** Dashboards VPS: manage + business./customer. per active apex. */
+  async listDashboardHosts(): Promise<{ hosts: string[] }> {
+    const adminHost =
+      this.config.get<string>('DASHBOARD_ADMIN_HOST')?.trim() || 'manage.meshkee.com';
+
+    const hosts = new Set<string>([adminHost]);
+    for (const apex of await this.listActiveApexHosts()) {
+      hosts.add(`business.${apex}`);
+      hosts.add(`customer.${apex}`);
+    }
+
+    return { hosts: [...hosts].sort() };
+  }
+
+  /**
+   * API VPS: central api host + api.{apex} aliases for each active domain.
+   * Same Nest process; nginx terminates TLS for every name on this list.
+   */
+  async listApiHosts(): Promise<{ hosts: string[] }> {
+    const centralHost =
+      this.config.get<string>('CENTRAL_API_HOST')?.trim() || 'api.meshkee.com';
+
+    const hosts = new Set<string>([centralHost]);
+    for (const apex of await this.listActiveApexHosts()) {
+      hosts.add(`api.${apex}`);
+    }
+
+    return { hosts: [...hosts].sort() };
+  }
+}

src/internal-ssl/ssl-sync-token.guard.ts

@@ -0,0 +1,35 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { timingSafeEqual } from 'crypto';
+import { Request } from 'express';
+
+@Injectable()
+export class SslSyncTokenGuard implements CanActivate {
+  constructor(private readonly config: ConfigService) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const expected = this.config.get<string>('SSL_SYNC_TOKEN')?.trim();
+    if (!expected) {
+      throw new UnauthorizedException('SSL sync is not configured');
+    }
+
+    const req = context.switchToHttp().getRequest<Request>();
+    const provided = String(req.headers['x-ssl-sync-token'] ?? '').trim();
+    if (!provided || provided.length !== expected.length) {
+      throw new UnauthorizedException('Invalid SSL sync token');
+    }
+
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    if (!timingSafeEqual(a, b)) {
+      throw new UnauthorizedException('Invalid SSL sync token');
+    }
+
+    return true;
+  }
+}