Skip dashboard SSL hosts without DNS and shorten sync errors.

Dashboard cert renewal no longer fails when unrelated tenants lack business/customer DNS records; Issue SSL errors summarize blocked hostnames instead of dumping certbot logs.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/domain-admin/domain-admin.service.ts

@@ -131,13 +131,34 @@ export class DomainAdminService {
     if (!response.ok) {
       const text = await response.text().catch(() => '');
       throw new ServiceUnavailableException(
-        `SSL sync agent rejected request (${response.status})${text ? `: ${text}` : ''}`,
+        `SSL sync agent rejected request (${response.status})${text ? `: ${this.summarizeSslSyncFailure(text)}` : ''}`,
       );
     }
 
     return response.json().catch(() => ({ status: opts.wait ? 'ok' : 'accepted' }));
   }
 
+  private summarizeSslSyncFailure(raw: string): string {
+    try {
+      const parsed = JSON.parse(raw) as { message?: string; log?: string };
+      const log = String(parsed.log ?? '');
+      const blocked = [
+        ...new Set(
+          [...log.matchAll(/Domain: ((?:business|customer)\.[^\n]+)/g)].map((m) => m[1].trim()),
+        ),
+      ];
+      if (blocked.length > 0) {
+        return (
+          `Dashboard cert blocked by missing DNS for: ${blocked.join(', ')}. ` +
+          'Add business/customer CNAMEs for those tenants or deactivate the domain, then retry.'
+        );
+      }
+      return String(parsed.message ?? raw).slice(0, 400);
+    } catch {
+      return raw.slice(0, 400);
+    }
+  }
+
   /**
    * Issue Let's Encrypt certs on the websites VM for storefront domains
    * whose live TLS probe fails. Do not trust ssl_enabled alone — a wrong