chore(backend): добавить поддержку ACME и управление сертификатами

backend/src/db/index.ts

@@ -338,6 +338,30 @@ CREATE TABLE IF NOT EXISTS alert_telegram_settings (
   updated_at TEXT NOT NULL DEFAULT (datetime('now'))
 );
 
+CREATE TABLE IF NOT EXISTS acme_settings (
+  id INTEGER PRIMARY KEY,
+  directory_url TEXT NOT NULL DEFAULT 'https://acme-v02.api.letsencrypt.org/directory',
+  cloudflare_api_token TEXT NOT NULL DEFAULT '',
+  default_zone_id TEXT NOT NULL DEFAULT '',
+  account_private_key TEXT NOT NULL DEFAULT '',
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS certificate_issue_jobs (
+  id TEXT PRIMARY KEY,
+  status TEXT NOT NULL DEFAULT 'queued',
+  step TEXT NOT NULL DEFAULT 'queued',
+  server_id TEXT NOT NULL,
+  cert_name TEXT NOT NULL,
+  domain_names TEXT NOT NULL,
+  key_type TEXT NOT NULL DEFAULT 'rsa2048',
+  trust_store TEXT NOT NULL DEFAULT 'www,api',
+  requested_at TEXT NOT NULL DEFAULT (datetime('now')),
+  started_at TEXT,
+  finished_at TEXT,
+  error TEXT
+);
+
 CREATE TABLE IF NOT EXISTS alert_rules (
   id TEXT PRIMARY KEY,
   name TEXT NOT NULL,
@@ -587,6 +611,12 @@ SELECT 1, '', ''
 WHERE NOT EXISTS (SELECT 1 FROM alert_telegram_settings WHERE id = 1);
 `)
 
+sqlite.exec(`
+INSERT INTO acme_settings (id, directory_url, cloudflare_api_token, default_zone_id, account_private_key)
+SELECT 1, 'https://acme-v02.api.letsencrypt.org/directory', '', '', ''
+WHERE NOT EXISTS (SELECT 1 FROM acme_settings WHERE id = 1);
+`)
+
 sqlite.exec(`
 INSERT INTO alert_engine_cursor (id, last_source_finished_at)
 SELECT 1, NULL

backend/src/db/schema.ts

@@ -287,6 +287,30 @@ export const alertTelegramSettings = sqliteTable("alert_telegram_settings", {
   updatedAt: text("updated_at").notNull().default(sql`(datetime('now'))`),
 })
 
+export const acmeSettings = sqliteTable("acme_settings", {
+  id:                 integer("id").primaryKey(),
+  directoryUrl:       text("directory_url").notNull().default("https://acme-v02.api.letsencrypt.org/directory"),
+  cloudflareApiToken: text("cloudflare_api_token").notNull().default(""),
+  defaultZoneId:      text("default_zone_id").notNull().default(""),
+  accountPrivateKey:  text("account_private_key").notNull().default(""),
+  updatedAt:          text("updated_at").notNull().default(sql`(datetime('now'))`),
+})
+
+export const certificateIssueJobs = sqliteTable("certificate_issue_jobs", {
+  id:          text("id").primaryKey(),
+  status:      text("status", { enum: ["queued", "running", "done", "failed"] }).notNull().default("queued"),
+  step:        text("step").notNull().default("queued"),
+  serverId:    text("server_id").notNull(),
+  certName:    text("cert_name").notNull(),
+  domainNames: text("domain_names").notNull(),
+  keyType:     text("key_type").notNull().default("rsa2048"),
+  trustStore:  text("trust_store").notNull().default("www,api"),
+  requestedAt: text("requested_at").notNull().default(sql`(datetime('now'))`),
+  startedAt:   text("started_at"),
+  finishedAt:  text("finished_at"),
+  error:       text("error"),
+})
+
 /** Группы правил: ANY = хотя бы одно; ALL = все одновременно в окне тика. */
 export const alertGroups = sqliteTable("alert_groups", {
   id:                text("id").primaryKey(),
@@ -505,6 +529,8 @@ export type SchedulerRunRow = typeof schedulerRuns.$inferSelect
 export type EventRow = typeof events.$inferSelect
 export type EvobgpSettingsRow = typeof evobgpSettings.$inferSelect
 export type AlertTelegramSettingsRow = typeof alertTelegramSettings.$inferSelect
+export type AcmeSettingsRow = typeof acmeSettings.$inferSelect
+export type CertificateIssueJobRow = typeof certificateIssueJobs.$inferSelect
 export type AlertGroupRow = typeof alertGroups.$inferSelect
 export type AlertRuleRow = typeof alertRules.$inferSelect
 export type AlertRuleTargetRow = typeof alertRuleTargets.$inferSelect