fix: ECC cert support, ACME deploy hook path, NAT detection, and account config fallback

- Add find_cert_dir() to resolve both RSA and ECC (domain_ecc/) cert dirs
- Copy acme deploy hook to /deploy/ where acme.sh resolves it
- _parse_account_conf checks both legacy .account.conf and declarative config
- Skip public DNS check when all local IPs are private (NAT)
- Improve check message strings for validity and expiry status
- Support timezone-aware date formats in _days_until parsing
- Filter out "no" SAN domains in cert listing
- Bump frontend asset version cache keys
- Fix DOMContentLoaded race condition in app.js boot
- Fix spread operator in certs.js modal template

daemon/handlers/acme.py

@@ -40,7 +40,9 @@ logger = logging.getLogger(__name__)
 
 PROJECT_DIR = Path(__file__).resolve().parent.parent.parent
 _ACME_HOME = PROJECT_DIR / "data" / "acme"
-_DEPLOY_HOOK = str(PROJECT_DIR / "system" / "acme-deploy.sh")
+# acme.sh resolves deploy hooks from $ACME_HOME/deploy/ -- _findHook
+# only searches the deploy subdirectory, never accepts absolute paths.
+_DEPLOY_HOOK = "acme-deploy.sh"
 
 _ACME_ENVIRON = {
     "HOME": str(PROJECT_DIR),
@@ -181,7 +183,7 @@ def _check_domain_format(domain: str) -> tuple[bool, str]:
     pattern = r"^[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*$"
     if not _re.match(pattern, domain):
         return False, "Invalid domain name format"
-    return True, ""
+    return True, "Domain format is valid"
 
 
 def _get_local_ips() -> set[str]:
@@ -343,10 +345,12 @@ def _check_existing_cert(domain: str) -> tuple[bool, str]:
     try:
         days = lib.acme.days_until_expiry(domain)
     except (RuntimeError, FileNotFoundError):
-        return True, ""
-    if days is not None and days > 0:
+        return True, "No existing certificate found"
+    if days is None:
+        return True, "No existing certificate found"
+    if days > 0:
         return True, f"Valid certificate exists ({days} days remaining)"
-    return True, ""
+    return True, f"Certificate expired ({abs(days)} days ago)"
 
 
 def _check_nginx_running() -> tuple[bool, str]:
@@ -497,7 +501,11 @@ def _check_port_80_listening() -> tuple[bool, str]:
 
 
 def _check_acme_account() -> tuple[bool, str]:
-    """Non-blocking: check acme.sh account is configured."""
+    """Non-blocking: check acme.sh account is configured.
+
+    Tries acme.sh --info first, then falls back to parsed account state
+    (handles both legacy .account.conf and modern declarative config).
+    """
     try:
         acme_bin = _find_acme_bin()
         acme_home_env = os.environ.get("ACME_HOME", str(_ACME_HOME))
@@ -520,14 +528,11 @@ def _check_acme_account() -> tuple[bool, str]:
     except (FileNotFoundError, subprocess.TimeoutExpired):
         pass
 
-    try:
-        account_conf = _ACME_HOME / ".account.conf"
-        if account_conf.is_file():
-            text = account_conf.read_text()
-            if "ACME_LEEMAIL" in text and "ACME_MCA" in text:
-                return True, "ACME account is configured"
-    except OSError:
-        pass
+    from lib.state import _parse_account_conf
+
+    info = _parse_account_conf(_ACME_HOME)
+    if info.get("registered"):
+        return True, "ACME account is configured"
 
     return (
         False,
@@ -538,17 +543,14 @@ def _check_acme_account() -> tuple[bool, str]:
 def _check_account_registered() -> tuple[bool, str]:
     """Blocking check: verify an ACME account is registered.
 
-    Reads the user-facing .account.conf (with leading dot) which stores
-    the registered account's ACME_LEEMAIL and ACME_MCA keys.
+    Delegates to ``lib.state._parse_account_conf()`` which checks both
+    the legacy .account.conf and the declarative config/acme/config.json
+    used by modern acme.sh (v3.x).
     """
-    account_conf = _ACME_HOME / ".account.conf"
-    if not account_conf.is_file():
-        return False, "Register an ACME account before issuing certificates"
-    try:
-        text = account_conf.read_text()
-    except OSError:
-        return False, "Register an ACME account before issuing certificates"
-    if "ACME_LEEMAIL" in text and "ACME_MCA" in text:
+    from lib.state import _parse_account_conf
+
+    info = _parse_account_conf(_ACME_HOME)
+    if info.get("registered"):
         return True, "ACME account is registered"
     return False, "Register an ACME account before issuing certificates"
 
@@ -571,6 +573,11 @@ def _check_dns_public(domain: str) -> tuple[bool, str]:
     if not local_ips:
         return True, "Public DNS check skipped (no local IPs detected)"
 
+    # Behind NAT: public DNS can never match local (private) IPs.
+    # dns_resolves already verified the domain correctly via external IP.
+    if all(_is_private_ip(ip) for ip in local_ips):
+        return True, "Public DNS check skipped (NAT detected — dns_resolves verified)"
+
     for dns_server in ("8.8.8.8", "1.1.1.1"):
         try:
             result = subprocess.run(
@@ -942,13 +949,14 @@ def get_cert_paths(_request: Any, body: dict[str, Any] | None) -> dict[str, str]
     if not body or "domain" not in body:
         raise ValueError("'domain' is required")
     domain = body["domain"]
-    acme_home_env = os.environ.get("ACME_HOME", str(_ACME_HOME))
-    acme_home = str(Path(acme_home_env) / domain)
+    from lib.acme import find_cert_dir
+
+    cert_dir = str(find_cert_dir(domain, _ACME_HOME))
     return {
-        "cert": f"{acme_home}/{domain}.cert",
-        "key": f"{acme_home}/{domain}.key",
-        "ca": f"{acme_home}/ca.cer",
-        "fullchain": f"{acme_home}/fullchain.cer",
+        "cert": f"{cert_dir}/{domain}.cert",
+        "key": f"{cert_dir}/{domain}.key",
+        "ca": f"{cert_dir}/ca.cer",
+        "fullchain": f"{cert_dir}/fullchain.cer",
     }