From 9524a11f2563cfd85f61f56eddee5499e14e53e2 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Wed, 9 Sep 2026 16:50:37 -0400
Subject: [PATCH] Wire up to start

---
 server/certificates.ts                   |  8 ++++++
 server/index.ts                          |  3 +++
 server/lib/retry.ts                      |  2 +-
 server/private/certificates.ts           | 17 +++++++++++++
 server/private/cleanup.ts                |  2 ++
 server/private/lib/certificates/index.ts | 32 +++++++++++-------------
 6 files changed, 45 insertions(+), 19 deletions(-)
 create mode 100644 server/certificates.ts
 create mode 100644 server/private/certificates.ts

diff --git a/server/certificates.ts b/server/certificates.ts
new file mode 100644
index 000000000..a0c922480
--- /dev/null
+++ b/server/certificates.ts
@@ -0,0 +1,8 @@
+export async function startCertificateManager() {
+    // No-op: ACME certificate generation/management is only available in
+    // builds that include the private/enterprise feature set.
+}
+
+export async function stopCertificateManager() {
+    // No-op counterpart to startCertificateManager.
+}
diff --git a/server/index.ts b/server/index.ts
index 8b60636fa..055dae57b 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -26,6 +26,7 @@ import { TraefikConfigManager } from "@server/lib/traefik/TraefikConfigManager";
 import { initCleanup } from "#dynamic/cleanup";
 import { startSchedulers } from "#dynamic/startSchedulers";
 import { startDnsServer } from "#dynamic/dns";
+import { startCertificateManager } from "#dynamic/certificates";
 import license from "#dynamic/license/license";
 import { fetchServerIp } from "@server/lib/serverIpService";
 import { initAiModelCatalog } from "@server/lib/aiModelCatalog";
@@ -48,6 +49,8 @@ async function startServers() {
 
     await startDnsServer();
 
+    await startCertificateManager();
+
     // Start all servers
     const apiServer = createApiServer();
     const internalServer = createInternalServer();
diff --git a/server/lib/retry.ts b/server/lib/retry.ts
index 76d6b8e25..abe04ee18 100644
--- a/server/lib/retry.ts
+++ b/server/lib/retry.ts
@@ -1,4 +1,4 @@
-import logger from "@lib/logger";
+import logger from "@server/logger";
 
 export async function withRetry<T>(
     fn: () => Promise<T>,
diff --git a/server/private/certificates.ts b/server/private/certificates.ts
new file mode 100644
index 000000000..1d085e49a
--- /dev/null
+++ b/server/private/certificates.ts
@@ -0,0 +1,17 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export {
+    startCertificateManager,
+    stopCertificateManager
+} from "./lib/certificates";
diff --git a/server/private/cleanup.ts b/server/private/cleanup.ts
index a8821e8be..58bef4ce5 100644
--- a/server/private/cleanup.ts
+++ b/server/private/cleanup.ts
@@ -21,6 +21,7 @@ import { stopPingAccumulator } from "@server/routers/newt/pingAccumulator";
 import { shutdownUsageRecorder } from "@server/lib/aiBudgetEnforcement";
 import { shutdownAiSessionLogger } from "@server/routers/aiGateway/logAiSession";
 import { stopDnsServer } from "./dns";
+import { stopCertificateManager } from "./certificates";
 
 async function cleanup() {
     await stopPingAccumulator();
@@ -33,6 +34,7 @@ async function cleanup() {
     await wsCleanup();
     await logStreamingManager.shutdown();
     await stopDnsServer();
+    await stopCertificateManager();
 
     process.exit(0);
 }
diff --git a/server/private/lib/certificates/index.ts b/server/private/lib/certificates/index.ts
index f5dfacb90..399881611 100644
--- a/server/private/lib/certificates/index.ts
+++ b/server/private/lib/certificates/index.ts
@@ -12,29 +12,25 @@
  */
 
 import logger from "@server/logger";
+import { privateConfig } from "#private/lib/config";
 import { acmeClientManager } from "./acme-client";
 import { jobScheduler } from "./scheduler";
 
-// Request a new certificate
-// await certificateService.addCertificateRequest(domain);
+export async function startCertificateManager() {
+    const acmeConfig = privateConfig.getRawPrivateConfig().acme;
+    if (!acmeConfig || acmeConfig.cert_mode !== "pangolin") {
+        return;
+    }
 
-logger.info("Starting certificate management server...");
+    logger.info("Starting certificate management server...");
 
-// Initialize ACME client
-await acmeClientManager.initialize();
+    // Initialize ACME client
+    await acmeClientManager.initialize();
 
-// Start job scheduler
-await jobScheduler.start();
+    // Start job scheduler
+    await jobScheduler.start();
+}
 
-// Graceful shutdown
-process.on("SIGTERM", async () => {
-    logger.info("Received SIGTERM, shutting down gracefully");
+export async function stopCertificateManager() {
     await jobScheduler.stop();
-    process.exit(0);
-});
-
-process.on("SIGINT", async () => {
-    logger.info("Received SIGINT, shutting down gracefully");
-    await jobScheduler.stop();
-    process.exit(0);
-});
+}