feat(nginx): sync missing configs on startup and surface write errors

- Add SyncConfigs() to recreate nginx configs for enabled domains
  missing on disk, called on every service startup
- Return writeAndReload error from Create instead of swallowing it
- Handle partial success in create handler (domain saved, config failed)

Author: Fokir

cmd/server/main.go

@@ -75,6 +75,11 @@ func main() {
 		slog.Error("failed to sync nftables rules on startup", "error", err)
 	}
 
+	// Sync nginx configs on startup
+	if err := nginxSvc.SyncConfigs(); err != nil {
+		slog.Error("failed to sync nginx configs on startup", "error", err)
+	}
+
 	// Handlers
 	authHandler := auth.NewHandler(authSvc)
 	natHandler := nftables.NewHandler(natSvc)

internal/nginx/handler.go

@@ -1,6 +1,7 @@
 package nginx
 
 import (
+	"log/slog"
 	"net/http"
 	"strconv"
 
@@ -47,10 +48,13 @@ func (h *Handler) create(w http.ResponseWriter, r *http.Request) {
 	}
 
 	domain, err := h.svc.Create(req)
-	if err != nil {
+	if err != nil && domain == nil {
 		httputil.Error(w, http.StatusBadRequest, err.Error())
 		return
 	}
+	if err != nil {
+		slog.Warn("domain created with config error", "error", err, "domain", domain.Domain)
+	}
 	httputil.JSON(w, http.StatusCreated, domain)
 }
 

internal/nginx/service.go

@@ -28,6 +28,33 @@ func (s *Service) GetAll() ([]Domain, error) {
 	return s.repo.GetAll()
 }
 
+// SyncConfigs writes nginx configs for all enabled domains that are missing on disk.
+func (s *Service) SyncConfigs() error {
+	if runtime.GOOS != "linux" {
+		return nil
+	}
+
+	domains, err := s.repo.GetAll()
+	if err != nil {
+		return fmt.Errorf("get domains: %w", err)
+	}
+
+	for _, d := range domains {
+		if !d.Enabled {
+			continue
+		}
+		path := s.configPath(d.Domain)
+		if _, err := os.Stat(path); err == nil {
+			continue // config already exists
+		}
+		slog.Info("syncing missing nginx config", "domain", d.Domain)
+		if err := s.writeAndReload(&d); err != nil {
+			slog.Error("failed to sync nginx config", "error", err, "domain", d.Domain)
+		}
+	}
+	return nil
+}
+
 func (s *Service) Create(req CreateDomainRequest) (*Domain, error) {
 	if err := validate.Domain(req.Domain); err != nil {
 		return nil, err
@@ -74,7 +101,7 @@ func (s *Service) Create(req CreateDomainRequest) (*Domain, error) {
 	}
 
 	if err := s.writeAndReload(domain); err != nil {
-		slog.Error("failed to write nginx config", "error", err, "domain", domain.Domain)
+		return domain, fmt.Errorf("domain created but nginx config failed: %w", err)
 	}
 
 	return domain, nil