Polish business FA layout and wire special-group keys plus SSL sync.

RTL carousels/FABs, special key+title fields, slider gallery fixes, and dashboard SSL sync agent for super-admin.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/meshkee-ssl-sync-agent.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Meshkee dashboards SSL sync agent
+After=network.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/meshkee/ssl-sync-agent.env
+ExecStart=/usr/bin/node /opt/meshkee/dashboards/deploy/ssl-sync-agent.mjs
+Restart=on-failure
+RestartSec=3
+User=root
+
+[Install]
+WantedBy=multi-user.target

deploy/ssl-sync-agent.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+/**
+ * Tiny HTTP agent on the dashboards VPS.
+ * Super Admin → Nest API → POST here → runs ssl-sync.sh in the background.
+ *
+ * Env (/etc/meshkee/ssl-sync-agent.env):
+ *   SSL_SYNC_AGENT_TOKEN=...
+ *   SSL_SYNC_SCRIPT=/opt/meshkee/dashboards/deploy/ssl-sync.sh
+ *   PORT=9051
+ *   BIND=0.0.0.0
+ */
+import { createServer } from 'node:http'
+import { spawn } from 'node:child_process'
+import { accessSync, constants } from 'node:fs'
+
+const TOKEN = (process.env.SSL_SYNC_AGENT_TOKEN || '').trim()
+const SCRIPT =
+  (process.env.SSL_SYNC_SCRIPT || '/opt/meshkee/dashboards/deploy/ssl-sync.sh').trim()
+const PORT = Number(process.env.PORT || 9051)
+const BIND = (process.env.BIND || '0.0.0.0').trim()
+
+if (!TOKEN) {
+  console.error('SSL_SYNC_AGENT_TOKEN is required')
+  process.exit(1)
+}
+
+try {
+  accessSync(SCRIPT, constants.X_OK)
+} catch {
+  console.error(`SSL sync script missing or not executable: ${SCRIPT}`)
+  process.exit(1)
+}
+
+let running = false
+
+function json(res, status, body) {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, {
+    'Content-Type': 'application/json',
+    'Content-Length': Buffer.byteLength(payload),
+  })
+  res.end(payload)
+}
+
+function startSync() {
+  running = true
+  const child = spawn(SCRIPT, [], {
+    detached: true,
+    stdio: 'ignore',
+    env: process.env,
+  })
+  child.on('error', (err) => {
+    console.error(`${new Date().toISOString()} spawn error:`, err.message)
+    running = false
+  })
+  child.on('exit', (code, signal) => {
+    console.log(
+      `${new Date().toISOString()} ssl-sync finished code=${code} signal=${signal ?? ''}`,
+    )
+    running = false
+  })
+  child.unref()
+}
+
+const server = createServer((req, res) => {
+  if (req.method === 'GET' && req.url === '/health') {
+    return json(res, 200, { ok: true, running })
+  }
+
+  if (req.method !== 'POST' || req.url !== '/ssl-sync') {
+    return json(res, 404, { error: 'not found' })
+  }
+
+  const provided = String(req.headers['x-ssl-sync-agent-token'] ?? '').trim()
+  if (!provided || provided !== TOKEN) {
+    return json(res, 401, { error: 'unauthorized' })
+  }
+
+  if (running) {
+    return json(res, 409, { error: 'ssl sync already running' })
+  }
+
+  startSync()
+  console.log(`${new Date().toISOString()} ssl-sync accepted`)
+  return json(res, 202, {
+    status: 'accepted',
+    message: 'SSL sync started',
+  })
+})
+
+server.listen(PORT, BIND, () => {
+  console.log(`ssl-sync-agent listening on ${BIND}:${PORT}`)
+})

deploy/ssl-sync.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Sync Let's Encrypt cert SANs with dashboard hosts from the API.
-# Cron: 0 */2 * * * /opt/meshkee/dashboards/scripts/ssl-sync.sh >> /var/log/meshkee-ssl-sync.log 2>&1
+# Cron: 0 */2 * * * /opt/meshkee/dashboards/deploy/ssl-sync.sh >> /var/log/meshkee-ssl-sync.log 2>&1
 set -euo pipefail
 
 CONF=/etc/meshkee/ssl-sync.env