Fix storefront SSL probes and per-domain ensure for dashboards.

Skip redundant provision on edit, harden TLS hostname checks, and issue apex/business/customer SSL from one endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/websites-agent/README.md

@@ -2,8 +2,11 @@
 #
 # Endpoints (X-Deploy-Token):
 #   POST /deploy     { slug }                    — git pull + build + pm2 restart
-#   POST /provision  { slug, host, gitRepoUrl }  — clone + nginx + ecosystem + allowlist
+#   POST /provision  { slug, host, gitRepoUrl }  — clone + nginx + ecosystem + allowlist (no certbot)
 #   POST /ssl        { host, slug? }             — certbot for apex + www (nginx must exist)
 #   GET  /health
 #
 # Env (.env): PORT, DEPLOY_TOKEN, ALLOWED_SLUGS
+#
+# Note: provision.sh intentionally skips certbot. SSL is issued via POST /ssl so
+# Edit/Add Domain does not hang when www DNS is wrong.

scripts/websites-agent/provision.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Provision a new storefront site on the websites VM (clone + nginx + pm2 entry + allowlist).
 # Does NOT run npm ci/build — first build happens via deploy.sh (Super Admin Deploy).
+# Does NOT run certbot — use ssl.sh / Super Admin Issue SSL (certbot blocked Edit Domain saves).
 set -euo pipefail
 
 SLUG="${1:-}"
@@ -142,10 +143,9 @@ else
   echo "nginx site already exists: $NGINX_AVAILABLE"
 fi
 
-if command -v certbot >/dev/null 2>&1; then
-  certbot --nginx -d "$HOST" -d "www.$HOST" --non-interactive --agree-tos --register-unsafely-without-email --redirect \
-    || echo "certbot skipped/failed (non-fatal)"
-fi
+# SSL is issued separately via ssl.sh / Super Admin "Issue SSL" — do not run
+# certbot here. It often hangs on www DNS mismatches and blocks the API request
+# (Edit domain modal stays open until the proxy times out).
 
 if [[ -f "$ENV_FILE" ]]; then
   CURRENT="$(grep -E '^ALLOWED_SLUGS=' "$ENV_FILE" | head -1 | cut -d= -f2- || true)"