From 511929d5793ddd3783c8b621aad71f27f112a820 Mon Sep 17 00:00:00 2001
From: jessikitty <jess.rogerson.29@outlook.com>
Date: Mon, 7 Sep 2026 10:01:49 +1000
Subject: [PATCH] Cert Fixes

---
 README.md           | 22 +++++++++++++++++++---
 scripts/gen-cert.sh |  6 ++++--
 src/tls.js          | 12 ++++++++++++
 3 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 5b5c2cb..cccff59 100644
--- a/README.md
+++ b/README.md
@@ -271,9 +271,25 @@ HOST_PORT=8443
 HTTPS_PUBLIC_PORT=8443
 ```
 
-An address that isn't listed produces a browser warning. Change the list and restart; the
-certificate reissues itself automatically, and devices that already trust the authority accept
-it without any further work.
+An address that isn't listed produces a browser warning.
+
+After changing anything in `.env`, bring the container back with **`docker compose up -d`**, not
+`docker compose restart`. Restart reuses the running container along with the environment it
+started with, so the edit appears to do nothing; `up -d` recreates it and picks the new values
+up. Confirm with:
+
+```bash
+docker compose exec visitor-signin printenv HTTPS_HOSTNAMES
+docker compose logs --tail=20 visitor-signin | grep tls
+```
+
+The log should say `renewing the server certificate: HTTPS_HOSTNAMES changed` and then list every
+name it now covers. If it lists only `localhost`, `visitors.local` and a `172.x` address, the
+variable never reached the container — those are the defaults plus the container's own docker
+bridge address.
+
+Reissuing does **not** touch the certificate authority, so devices that already trust it keep
+working and no MDM profile needs redeploying.
 
 The kiosk is then at `https://visitors.local:8443`, admin at `https://visitors.local:8443/admin`.
 
diff --git a/scripts/gen-cert.sh b/scripts/gen-cert.sh
index 778dc01..33502d6 100644
--- a/scripts/gen-cert.sh
+++ b/scripts/gen-cert.sh
@@ -25,8 +25,10 @@ fi
 
 if docker compose ps --status running 2>/dev/null | grep -q visitor-signin; then
   docker compose exec -T visitor-signin node scripts/make-cert.mjs $FORCE
-  echo "Restarting so the new certificate is served..."
-  docker compose restart visitor-signin
+  echo "Recreating the container so the new certificate is served..."
+  # up -d rather than restart: restart keeps the environment the container was
+  # started with, so an edited .env would be ignored.
+  docker compose up -d visitor-signin
 else
   node scripts/make-cert.mjs $FORCE
 fi
diff --git a/src/tls.js b/src/tls.js
index 1145c1d..601ed1c 100644
--- a/src/tls.js
+++ b/src/tls.js
@@ -194,6 +194,18 @@ export function ensureCertificates({ force = false } = {}) {
     fs.writeFileSync(p.names, JSON.stringify(config.https.hostnames));
   }
 
+  // A very common mistake is editing .env and then using `docker compose restart`,
+  // which reuses the old environment. The symptom is a certificate covering only
+  // the defaults, so say so rather than letting it fail later in a browser.
+  const configured = config.https.hostnames;
+  if (configured.length === 1 && configured[0] === 'visitors.local') {
+    console.warn(
+      '[tls] HTTPS_HOSTNAMES is at its default. If you set it in .env, bring the container\n' +
+        '      back with "docker compose up -d" rather than "docker compose restart" — restart\n' +
+        '      keeps the environment the container started with.'
+    );
+  }
+
   return {
     key: fs.readFileSync(p.key),
     cert: fs.readFileSync(p.cert),