修复SSL挑战方式配置迁移

backend/config/config.go

@@ -121,6 +121,11 @@ func (c *Config) SetSetupPort(setupPort int) {
 const DBTypeMySQL = "mysql"
 const DBTypeSQLite = "sqlite"
 const DBTypePostgres = "postgres"
+
+const (
+	SSLChallengeHTTP = "http"
+	SSLChallengeDNS  = "dns"
+)
 const SSLTypeAutoHTTP = "0" //自动生成证书
 const SSLTypeAutoDNS = "2"  //自动生成证书，DNS api验证
 const SSLTypeUser = "1"     //用户上传证书

backend/config/migrate.go

@@ -737,6 +737,12 @@ func legacySSLConfig(legacy legacyMigrationConfig) (SSLConfig, []string) {
 	certificateRef, certificateOK := legacyControlledReference(legacy.SSLPublicKeyPath)
 	privateKeyRef, privateKeyOK := legacyControlledReference(legacy.SSLPrivateKeyPath)
 	ssl := SSLConfig{Mode: ManagedSSLModeDefault, DefaultDirectory: "config/ssl"}
+	switch legacy.SSLType {
+	case SSLTypeAutoDNS:
+		ssl.Challenge = SSLChallengeDNS
+	case SSLTypeAutoHTTP:
+		ssl.Challenge = SSLChallengeHTTP
+	}
 	if legacy.SSLType == SSLTypeUser {
 		ssl.Mode = ManagedSSLModeUpload
 		ssl.CustomDirectory = "config/ssl"

backend/config/model.go

@@ -107,6 +107,7 @@ type SSLConfig struct {
 	Mode             string `json:"mode"`
 	DefaultDirectory string `json:"defaultDirectory"`
 	CustomDirectory  string `json:"customDirectory,omitempty"`
+	Challenge        string `json:"challenge,omitempty"`
 	CertificateRef   string `json:"certificateRef,omitempty"`
 	PrivateKeyRef    string `json:"privateKeyRef,omitempty"`
 }

backend/config/partitioned_compatibility.go

@@ -74,7 +74,11 @@ func loadPartitionedCompatibility() (*Config, error) {
 	}
 	tls := runtime.SSL.TLS
 	if tls.Mode == ManagedSSLModeDefault {
-		cfg.SSLType = SSLTypeAutoHTTP
+		if tls.Challenge == SSLChallengeDNS {
+			cfg.SSLType = SSLTypeAutoDNS
+		} else {
+			cfg.SSLType = SSLTypeAutoHTTP
+		}
 	}
 	// 迁移器保留的旧证书引用仍走严格的只读文件校验；新托管引用沿用托管解析器。
 	if strings.HasPrefix(tls.CertificateRef, managedSSLRelativeRoot+"/") {

backend/config/validator.go

@@ -186,6 +186,9 @@ func validateSSL(ssl SSLConfig) error {
 	if !isControlledRelativePath(ssl.DefaultDirectory) {
 		return ErrInvalidSSL
 	}
+	if ssl.Challenge != "" && ssl.Challenge != SSLChallengeHTTP && ssl.Challenge != SSLChallengeDNS {
+		return ErrInvalidSSL
+	}
 	activeDirectory := ssl.DefaultDirectory
 	switch ssl.Mode {
 	case ManagedSSLModeDefault, "default":