-- Store Let's Encrypt / TLS notAfter after a successful SSL issue.
-- List Valid/Invalid prefers this date; live probes run at most once per day.
ALTER TABLE domains
  ADD COLUMN IF NOT EXISTS ssl_expires_at TIMESTAMPTZ;

CREATE INDEX IF NOT EXISTS idx_domains_ssl_expires_at
  ON domains (ssl_expires_at)
  WHERE ssl_expires_at IS NOT NULL;