fix(certificates): не мониторить SSL без health-check с TLS verify

Биндинги с выключенным health-check (imsk/mmsk) исключаются из авто-мониторинга; sticky footer в редактировании сервиса.

Co-authored-by: Cursor <[email protected]>

apps/api/src/services/certificate-service.ts

@@ -142,11 +142,27 @@ function bindingSubdomain(
   return repos.findSubdomainByDomainAndName(db, domainId, hostname);
 }
 
-/** Health-check without TLS verify implies invalid certs — skip SSL monitoring. */
-function skipsSslDueToHealthTls(
-  group: { health_check_enabled: boolean; health_check_verify_tls: boolean } | null,
+type HealthTlsFlags = {
+  health_check_enabled: boolean;
+  health_check_verify_tls: boolean;
+};
+
+/**
+ * Auto SSL monitoring follows effective health-check with TLS verify.
+ * No health → no SSL. Health without verify_tls (self-signed) → no SSL.
+ * Binding inherits group health when its own health is off.
+ */
+function hasSslHealthGate(
+  own: HealthTlsFlags,
+  group: (HealthTlsFlags & { enabled: boolean }) | null,
 ): boolean {
-  return Boolean(group?.health_check_enabled && !group.health_check_verify_tls);
+  if (own.health_check_enabled) {
+    return own.health_check_verify_tls;
+  }
+  if (group?.enabled && group.health_check_enabled) {
+    return group.health_check_verify_tls;
+  }
+  return false;
 }
 
 export function buildServiceCertificateFqdns(
@@ -160,7 +176,17 @@ export function buildServiceCertificateFqdns(
       ? repos.getServiceGroup(db, service.service_group_id)
       : null;
     if (!shouldMonitorService(service, group)) continue;
-    if (skipsSslDueToHealthTls(group)) continue;
+    if (
+      !hasSslHealthGate(
+        {
+          health_check_enabled: binding.health_check_enabled,
+          health_check_verify_tls: binding.health_check_verify_tls,
+        },
+        group,
+      )
+    ) {
+      continue;
+    }
 
     const subdomain = bindingSubdomain(db, binding.domain_id, binding.hostname);
     if (subdomain && !subdomain.enabled) continue;
@@ -176,7 +202,7 @@ export function buildServiceCertificateFqdns(
   const knownZones = repos.listAllDomains(db).map((d) => d.zone_name);
   for (const group of repos.listServiceGroups(db)) {
     if (!group.enabled || !group.domain?.trim()) continue;
-    if (skipsSslDueToHealthTls(group)) continue;
+    if (!group.health_check_enabled || !group.health_check_verify_tls) continue;
 
     const parsed = parseFqdn(group.domain, knownZones);
     if (!parsed) continue;