fix(acme): ensure HTTP-01 challenge and reverse proxy are always served on port 80 even if www management service is disabled

VERSION

@@ -1 +1 @@
-1.5.0
+1.5.1

cmd/server/main.go

@@ -358,7 +358,10 @@ func main() {
 		httpMu.Lock()
 		defer httpMu.Unlock()
 		old := httpServer
-		if disabled {
+		// If www is disabled for management, keep HTTP port 80 listening if Reverse Proxy is enabled,
+		// so that reverse proxy rules and Let's Encrypt ACME HTTP-01 challenges continue functioning.
+		proxyActive := (proxyMgr != nil && proxyMgr.IsEnabled())
+		if disabled && !proxyActive {
 			httpServer = nil
 			if old != nil {
 				go old.Shutdown(context.Background())

internal/api/api.go

@@ -485,20 +485,6 @@ func (s *Server) registerRoutes() {
 }
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// HTTP and HTTPS have independent management service settings.
-	if s.servicesMgr != nil {
-		service := "www"
-		if r.TLS != nil {
-			service = "www-ssl"
-		}
-		if www, ok := s.servicesMgr.GetService(service); ok && www.Disabled {
-			w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-			w.WriteHeader(http.StatusServiceUnavailable)
-			_, _ = fmt.Fprintf(w, "503 Service Unavailable: %s management service is disabled\n", service)
-			return
-		}
-	}
-
 	// Enable CORS for local development/testing
 	w.Header().Set("Access-Control-Allow-Origin", "*")
 	w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS, PUT")
@@ -511,18 +497,37 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	path := r.URL.Path
 
-	// Reverse Proxy interceptor (prior to authentication and static handlers)
+	// 1. ACME challenge responder MUST always be accessible on port 80
+	if strings.HasPrefix(path, "/.well-known/acme-challenge/") {
+		s.mux.ServeHTTP(w, r)
+		return
+	}
+
+	// 2. Reverse Proxy interceptor (prior to management checks, auth and static handlers)
 	if s.proxyMgr != nil && s.proxyMgr.IsEnabled() {
-		isACME := strings.HasPrefix(path, "/.well-known/acme-challenge/")
 		isMgmtAPI := strings.HasPrefix(path, "/api/")
 
-		if !isACME && !isMgmtAPI {
+		if !isMgmtAPI {
 			if s.proxyMgr.HandleHTTP(w, r) {
 				return
 			}
 		}
 	}
 
+	// 3. HTTP and HTTPS independent management service settings for DebTik Web UI / API
+	if s.servicesMgr != nil {
+		service := "www"
+		if r.TLS != nil {
+			service = "www-ssl"
+		}
+		if www, ok := s.servicesMgr.GetService(service); ok && www.Disabled {
+			w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+			w.WriteHeader(http.StatusServiceUnavailable)
+			_, _ = fmt.Fprintf(w, "503 Service Unavailable: %s management service is disabled\n", service)
+			return
+		}
+	}
+
 	// Authentication protection for API routes
 	if strings.HasPrefix(path, "/api/") {
 		// Public endpoint: Login