fix(dashmate): overwrite mounted certificate files in place on renewal

The gateway container bind mounts bundle.crt and private.key as single files, so it stays attached to the mounted inode for its lifetime. Installing replacements with renameSync created a new inode the running container never saw, leaving the SIGHUP hot restart serving the old certificate. Overwrite existing destinations in place and keep renameSync only for first-time installation, where no mount can reference the path yet.

Author: PastaPastaPasta

packages/dashmate/src/listr/tasks/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.js

@@ -350,14 +350,27 @@ and all Dash service ports listed above.`);
               return {
                 stagedFilePath,
                 filePath,
+                content,
                 wasPresent,
                 previousContent,
               };
             });
 
             artifactInstallStarted = true;
-            stagedArtifacts.forEach(({ stagedFilePath, filePath }) => {
-              fs.renameSync(stagedFilePath, filePath);
+            stagedArtifacts.forEach(({
+              stagedFilePath, filePath, content, wasPresent,
+            }) => {
+              if (wasPresent) {
+                // The gateway container bind mounts bundle.crt and private.key
+                // as single files, so it stays attached to the mounted inode
+                // for its lifetime. Overwrite in place so the renewal SIGHUP
+                // hot restart reads the new contents; renameSync would install
+                // a new inode the running container never sees.
+                fs.writeFileSync(filePath, content, 'utf8');
+                fs.rmSync(stagedFilePath, { force: true });
+              } else {
+                fs.renameSync(stagedFilePath, filePath);
+              }
             });
 
             if (ctx.isCertificateCreated) {

packages/dashmate/test/unit/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.spec.js

@@ -307,6 +307,44 @@ describe('obtainZeroSSLCertificateTaskFactory', () => {
       });
     });
 
+    it('should overwrite existing artifacts in place to preserve bind-mounted inodes', async function it() {
+      const configValues = {
+        'platform.gateway.ssl.enabled': true,
+        'platform.gateway.ssl.provider': 'zerossl',
+        'platform.gateway.ssl.providerConfigs.zerossl.apiKey': 'test-api-key',
+        'platform.gateway.ssl.providerConfigs.zerossl.id': 'old-cert-id',
+        externalIp: '1.2.3.4',
+      };
+      config.get.callsFake((configPath) => configValues[configPath]);
+      config.set.callsFake((configPath, value) => {
+        configValues[configPath] = value;
+      });
+
+      const previousArtifacts = {
+        [path.join(sslConfigDir, 'private.key')]: 'OLD_PRIVATE_KEY_PEM',
+        [path.join(sslConfigDir, 'csr.pem')]: 'OLD_CSR_PEM',
+        [path.join(sslConfigDir, 'bundle.crt')]: 'OLD_CERT_BUNDLE_PEM',
+      };
+      this.sinon.stub(fs, 'existsSync').callsFake(
+        (filePath) => Object.hasOwn(previousArtifacts, filePath),
+      );
+      this.sinon.stub(fs, 'readFileSync').callsFake((filePath) => previousArtifacts[filePath]);
+
+      const clock = this.sinon.useFakeTimers();
+      const tasks = obtainZeroSSLCertificateTask(config);
+      const runPromise = tasks.run({ expirationDays: 30, force: true });
+      await clock.tickAsync(5000);
+      await runPromise;
+
+      // Replacement contents must land on the existing destination inodes,
+      // which the gateway container's single-file bind mounts stay attached to.
+      expect(fs.writeFileSync).to.have.been.calledWith(path.join(sslConfigDir, 'private.key'), 'PRIVATE_KEY_PEM', 'utf8');
+      expect(fs.writeFileSync).to.have.been.calledWith(path.join(sslConfigDir, 'csr.pem'), 'CSR_PEM', 'utf8');
+      expect(fs.writeFileSync).to.have.been.calledWith(path.join(sslConfigDir, 'bundle.crt'), 'CERT_BUNDLE_PEM', 'utf8');
+      // renameSync would create new inodes the running container never sees.
+      expect(fs.renameSync).to.not.have.been.called();
+    });
+
     it('should stage the private key with owner-only permissions', async function it() {
       const configValues = {
         'platform.gateway.ssl.providerConfigs.zerossl.apiKey': 'test-api-key',