Fix: apply-domains mit Backup/Restore + robuster Cert-Erkennung

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/mailwolt-apply-domains

@@ -96,13 +96,24 @@ if [ "${SSL_AUTO}" = "1" ]; then
 fi
 
 # --- Phase 3: Finale Vhosts ---
-# Nur HTTPS wenn LE-Cert tatsächlich vorhanden, sonst HTTP-only (kein self-signed Fallback)
-UI_HAS_CERT=0
-WM_HAS_CERT=0
-MAIL_HAS_CERT=0
-[ -f "/etc/letsencrypt/live/${UI_HOST}/fullchain.pem" ]      && UI_HAS_CERT=1
-[ -f "/etc/letsencrypt/live/${WEBMAIL_HOST}/fullchain.pem" ] && WM_HAS_CERT=1
-[ -f "/etc/letsencrypt/live/${MAIL_HOST}/fullchain.pem" ]    && MAIL_HAS_CERT=1
+# Backup der aktuellen nginx-Config (Wiederherstellung bei Fehler)
+NGINX_BACKUP="${NGINX_SITE}.bak"
+[ -f "${NGINX_SITE}" ] && cp "${NGINX_SITE}" "${NGINX_BACKUP}"
+
+# Cert-Erkennung: fullchain.pem direkt, Renewal-Datei, oder umbenannter Cert-Ordner
+cert_exists() {
+  local d="$1"
+  [ -z "$d" ] && return 1
+  [ -f "/etc/letsencrypt/live/${d}/fullchain.pem" ] && return 0
+  [ -f "/etc/letsencrypt/renewal/${d}.conf" ]       && return 0
+  ls "/etc/letsencrypt/live/${d}"-*/fullchain.pem 2>/dev/null | grep -q . && return 0
+  return 1
+}
+
+UI_HAS_CERT=0; WM_HAS_CERT=0; MAIL_HAS_CERT=0
+cert_exists "${UI_HOST}"      && UI_HAS_CERT=1
+cert_exists "${WEBMAIL_HOST}" && WM_HAS_CERT=1
+cert_exists "${MAIL_HOST}"    && MAIL_HAS_CERT=1
 (
 
 if [ "${UI_HAS_CERT}" = "1" ] || [ "${WM_HAS_CERT}" = "1" ]; then
@@ -331,5 +342,13 @@ if [ -n "${UI_HOST}" ] && [ -f "${ENV_FILE}" ]; then
   php "${APP_DIR}/artisan" optimize:clear --quiet 2>/dev/null || true
 fi
 
-nginx -t && systemctl reload nginx
-echo "mailwolt-apply-domains fertig"
+if nginx -t 2>/dev/null; then
+  systemctl reload nginx
+  echo "mailwolt-apply-domains fertig"
+else
+  echo "[!] nginx -t fehlgeschlagen — alte Konfiguration wird wiederhergestellt"
+  [ -f "${NGINX_BACKUP}" ] && cp "${NGINX_BACKUP}" "${NGINX_SITE}"
+  nginx -t && systemctl reload nginx
+  echo "[!] mailwolt-apply-domains mit Fehler beendet"
+  exit 1
+fi