Custom domains: verify, point, certificate, switch, remove
Imported from GitHub issue El-SaMa/lamoi-waas#6 by @El-SaMa.
Flow
- Client (or TEKORI for them) adds
example.fiin the OMA portal. - OMA shows the records (A/AAAA for apex, CNAME
www→<site>.lamoi.fi) and a TXT ownership token. Domains bought or hosted in OMA are pointed automatically. - Verification job checks DNS (OMA DNS tools), then issues a certificate for the domain (HTTP-01, or on-demand TLS in the web server with an allowlist so random hostnames cannot trigger issuance).
- Primary domain switches: site URL updated,
<site>.lamoi.fi301 → custom domain, apex ↔ www redirect as chosen. - Removal reverses it cleanly; certificate revoked or left to expire.
Tasks
- Implement with the #5 decision (fork's domain mapping or own).
- Certificate issuance and renewal per domain, with alerting.
- Mixed-content safe URL switch (search-replace in the subsite's tables only).
- Cloudflare-proxied client domains: document what works (Full strict) and what to tell clients.
- Connector op + MCP tool (#16, El-SaMa/oma#173).
Acceptance criteria
- End-to-end on staging with a test domain: add, verify, HTTPS, switch, remove.
Depends on
#3, #5.
Plan key W6. Epic: El-SaMa/lamoi-waas#25.