fix: nginx falhando no firstboot (corrida cert/key com 15regen-sslcert)

changelog

@@ -15,4 +15,8 @@ turnkey-opencloud-18.1 (1) turnkey; urgency=low
   * Firstboot inithooks: regenerate build-time secrets (opencloud.yaml),
     set admin password and domain (interactive or preseeded).
 
+  * Fix nginx failing at firstboot (cert/key mismatch race with the common
+    15regen-sslcert hook): nginx drop-in with Restart=on-failure and an
+    unconditional nginx restart at the end of the opencloud inithook.
+
  -- POP Solutions <popsolutions.co@gmail.com>  Tue, 21 Jul 2026 20:30:00 +0000

overlay/etc/systemd/system/nginx.service.d/opencloud.conf

@@ -0,0 +1,10 @@
+# Firstboot: 15regen-sslcert regenerates the TLS cert/key while nginx may be
+# starting; reading a mid-regen mismatched pair fails the unit, and the
+# regen hook only restarts services that are still active. Keep retrying so
+# nginx comes up on its own once the pair is consistent.
+[Unit]
+StartLimitIntervalSec=0
+
+[Service]
+Restart=on-failure
+RestartSec=10

overlay/usr/lib/inithooks/bin/opencloud.py

@@ -101,6 +101,10 @@ def set_domain(domain: str) -> None:
     # unconditional restart: 20regen-opencloud-secrets stopped the service,
     # so try-restart would be a no-op and leave OpenCloud down
     subprocess.run(["systemctl", "restart", "opencloud"], check=False)
+    # nginx can fail at boot if it starts while 15regen-sslcert is mid-way
+    # through regenerating the cert/key pair (mismatch); the common hook only
+    # restarts services that are still active, so recover it here
+    subprocess.run(["systemctl", "restart", "nginx"], check=False)
 
 
 def main():