From 091a8efd858f17a45756601088ca7f8f1e2c5a98 Mon Sep 17 00:00:00 2001
From: isaacclad <clad.impressions@gmail.com>
Date: Fri, 26 Jun 2026 18:47:33 +0000
Subject: [PATCH] Register issued certs with Ladill Domains central SSL
 registry

After provisioning a site cert on its node, report it to Domains' central SSL
registry (best-effort, non-blocking) so Domains tracks every platform cert.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 app/Jobs/ProvisionHostingSslJob.php     |  3 +++
 app/Services/Ssl/CentralSslRegistry.php | 34 +++++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 app/Services/Ssl/CentralSslRegistry.php

diff --git a/app/Jobs/ProvisionHostingSslJob.php b/app/Jobs/ProvisionHostingSslJob.php
index 052d68a..e305be3 100644
--- a/app/Jobs/ProvisionHostingSslJob.php
+++ b/app/Jobs/ProvisionHostingSslJob.php
@@ -70,6 +70,9 @@ class ProvisionHostingSslJob implements ShouldQueue
                 'site_id' => $this->siteId,
                 'domain' => $site->domain,
             ]);
+
+            // Record the cert in Ladill Domains' central SSL registry (best-effort).
+            app(\App\Services\Ssl\CentralSslRegistry::class)->register($site->domain, $site->ssl_expires_at);
         } catch (\Throwable $exception) {
             $message = $exception->getMessage();
 
diff --git a/app/Services/Ssl/CentralSslRegistry.php b/app/Services/Ssl/CentralSslRegistry.php
new file mode 100644
index 0000000..d72fb40
--- /dev/null
+++ b/app/Services/Ssl/CentralSslRegistry.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Services\Ssl;
+
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Reports certificates this app issued (per hosting node) to Ladill Domains'
+ * central SSL registry, so Domains is the single source of truth for every
+ * platform certificate. Best-effort and non-blocking — issuance stays local.
+ */
+class CentralSslRegistry
+{
+    public function register(string $host, ?\DateTimeInterface $expiresAt = null): void
+    {
+        $url = rtrim((string) config('domains.api_url'), '/');
+        $key = (string) config('domains.api_key');
+        if ($url === '' || $key === '' || $host === '') {
+            return;
+        }
+
+        try {
+            Http::withToken($key)->acceptJson()->timeout(10)
+                ->post($url.'/ssl/register', array_filter([
+                    'host' => $host,
+                    'status' => 'active',
+                    'expires_at' => $expiresAt?->format(DATE_ATOM),
+                ]));
+        } catch (\Throwable $e) {
+            Log::info('CentralSslRegistry: register skipped', ['host' => $host, 'error' => $e->getMessage()]);
+        }
+    }
+}