Wire up to start

server/certificates.ts

@@ -0,0 +1,8 @@
+export async function startCertificateManager() {
+    // No-op: ACME certificate generation/management is only available in
+    // builds that include the private/enterprise feature set.
+}
+
+export async function stopCertificateManager() {
+    // No-op counterpart to startCertificateManager.
+}

server/index.ts

@@ -26,6 +26,7 @@ import { TraefikConfigManager } from "@server/lib/traefik/TraefikConfigManager";
 import { initCleanup } from "#dynamic/cleanup";
 import { startSchedulers } from "#dynamic/startSchedulers";
 import { startDnsServer } from "#dynamic/dns";
+import { startCertificateManager } from "#dynamic/certificates";
 import license from "#dynamic/license/license";
 import { fetchServerIp } from "@server/lib/serverIpService";
 import { initAiModelCatalog } from "@server/lib/aiModelCatalog";
@@ -48,6 +49,8 @@ async function startServers() {
 
     await startDnsServer();
 
+    await startCertificateManager();
+
     // Start all servers
     const apiServer = createApiServer();
     const internalServer = createInternalServer();

server/lib/retry.ts

@@ -1,4 +1,4 @@
-import logger from "@lib/logger";
+import logger from "@server/logger";
 
 export async function withRetry<T>(
     fn: () => Promise<T>,

server/private/certificates.ts

@@ -0,0 +1,17 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export {
+    startCertificateManager,
+    stopCertificateManager
+} from "./lib/certificates";

server/private/cleanup.ts

@@ -21,6 +21,7 @@ import { stopPingAccumulator } from "@server/routers/newt/pingAccumulator";
 import { shutdownUsageRecorder } from "@server/lib/aiBudgetEnforcement";
 import { shutdownAiSessionLogger } from "@server/routers/aiGateway/logAiSession";
 import { stopDnsServer } from "./dns";
+import { stopCertificateManager } from "./certificates";
 
 async function cleanup() {
     await stopPingAccumulator();
@@ -33,6 +34,7 @@ async function cleanup() {
     await wsCleanup();
     await logStreamingManager.shutdown();
     await stopDnsServer();
+    await stopCertificateManager();
 
     process.exit(0);
 }

server/private/lib/certificates/index.ts

@@ -12,29 +12,25 @@
  */
 
 import logger from "@server/logger";
+import { privateConfig } from "#private/lib/config";
 import { acmeClientManager } from "./acme-client";
 import { jobScheduler } from "./scheduler";
 
-// Request a new certificate
-// await certificateService.addCertificateRequest(domain);
+export async function startCertificateManager() {
+    const acmeConfig = privateConfig.getRawPrivateConfig().acme;
+    if (!acmeConfig || acmeConfig.cert_mode !== "pangolin") {
+        return;
+    }
 
-logger.info("Starting certificate management server...");
+    logger.info("Starting certificate management server...");
 
-// Initialize ACME client
-await acmeClientManager.initialize();
+    // Initialize ACME client
+    await acmeClientManager.initialize();
 
-// Start job scheduler
-await jobScheduler.start();
+    // Start job scheduler
+    await jobScheduler.start();
+}
 
-// Graceful shutdown
-process.on("SIGTERM", async () => {
-    logger.info("Received SIGTERM, shutting down gracefully");
+export async function stopCertificateManager() {
     await jobScheduler.stop();
-    process.exit(0);
-});
-
-process.on("SIGINT", async () => {
-    logger.info("Received SIGINT, shutting down gracefully");
-    await jobScheduler.stop();
-    process.exit(0);
-});
+}