ladill-hosting/app/Jobs/ProvisionHostingSslJob.php

<?php

namespace App\Jobs;

use App\Models\HostedSite;
use App\Services\Hosting\Providers\SharedNodeProvider;
use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldQueue;
use Illuminate\Foundation\Bus\Dispatchable;
use Illuminate\Queue\InteractsWithQueue;
use Illuminate\Queue\SerializesModels;
use Illuminate\Support\Facades\Log;

class ProvisionHostingSslJob implements ShouldQueue
{
    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;

    public int $tries = 8;
    public int $timeout = 180; // 3 minutes for certbot
    public array $backoff = [300, 600, 1800, 3600, 7200, 14400, 21600]; // Retry across typical DNS propagation windows

    public function __construct(
        private int $siteId,
    ) {
    }

    public function handle(SharedNodeProvider $provider): void
    {
        $site = HostedSite::with(['account.node', 'account.user'])->find($this->siteId);

        if (! $site) {
            Log::warning('ProvisionHostingSslJob: Site not found', ['site_id' => $this->siteId]);
            return;
        }

        // Skip if already has SSL
        if ($site->ssl_enabled && $site->ssl_status === 'issued') {
            Log::info('ProvisionHostingSslJob: SSL already active', ['site_id' => $this->siteId, 'domain' => $site->domain]);
            return;
        }

        $account = $site->account;
        if (! $account || ! $account->node) {
            Log::error('ProvisionHostingSslJob: No account or node', ['site_id' => $this->siteId]);
            return;
        }

        // Skip if account is not active
        if ($account->status !== 'active') {
            Log::info('ProvisionHostingSslJob: Account not active, skipping SSL', [
                'site_id' => $this->siteId,
                'account_status' => $account->status,
            ]);
            return;
        }

        $site->update(['ssl_status' => 'provisioning']);

        // Surface this site's domain in Ladill Domains' "My Domains" (best-effort,
        // independent of SSL outcome).
        if ($account->user?->public_id) {
            app(\App\Services\Ssl\CentralSslRegistry::class)->registerConnectedDomain(
                $site->domain,
                (string) $account->user->public_id,
                'Hosting: '.$site->domain,
            );
        }

        try {
            $provider->requestLetsEncryptCertificate($site);

            $site->update([
                'ssl_enabled' => true,
                'ssl_status' => 'issued',
                'ssl_provisioned_at' => now(),
                'ssl_expires_at' => now()->addDays(90),
            ]);

            if ($site->domain_id) {
                \App\Models\Domain::query()->whereKey($site->domain_id)->update([
                    'ssl_status' => 'active',
                    'ssl_expires_at' => $site->ssl_expires_at,
                ]);
            }

            Log::info('ProvisionHostingSslJob: SSL provisioned successfully', [
                'site_id' => $this->siteId,
                'domain' => $site->domain,
            ]);

            // Record the cert in Ladill Domains' central SSL registry (best-effort).
            app(\App\Services\Ssl\CentralSslRegistry::class)->register($site->domain, $site->ssl_expires_at);
        } catch (\Throwable $exception) {
            $message = $exception->getMessage();

            // Check if it's a DNS propagation issue (should retry)
            $isDnsIssue = str_contains($message, 'DNS problem')
                || str_contains($message, 'NXDOMAIN')
                || str_contains($message, 'no valid A records')
                || str_contains($message, 'Timeout');

            $site->update([
                'ssl_status' => 'failed',
                'ssl_error' => $message,
            ]);

            Log::error('ProvisionHostingSslJob: Failed to provision SSL', [
                'site_id' => $this->siteId,
                'domain' => $site->domain,
                'error' => $message,
                'is_dns_issue' => $isDnsIssue,
            ]);

            // Re-throw to trigger retry (especially for DNS issues)
            throw $exception;
        }
    }

    public function failed(\Throwable $exception): void
    {
        Log::error('ProvisionHostingSslJob: Job failed after all retries', [
            'site_id' => $this->siteId,
            'error' => $exception->getMessage(),
        ]);

        $site = HostedSite::find($this->siteId);
        if ($site) {
            $site->update([
                'ssl_status' => 'failed',
                'ssl_error' => 'SSL provisioning failed after multiple attempts: ' . $exception->getMessage(),
            ]);
        }
    }
}