fix: validate site domain before it reaches nginx server_name

packages/ts-cloud/src/deploy/management-dashboard.tsmodified+8-2

Changes to packages/ts-cloud/src/deploy/management-dashboard.ts

		⋯96 linesShow the 96 lines above this hunk@@ -97,10 +97,16 @@ export function resolveDashboardAuth(cwd: string, username: string, logger: Ensu
97	97	mkdirSync(dirname(file), { recursive: true })
98	98	writeFileSync(file, `${JSON.stringify({ username, password, generatedAt: new Date().toISOString() }, null, 2)}\n`)
99	99	chmodSync(file, 0o600)
100		- logger.info(`Management dashboard: generated a password and saved it to ${DASHBOARD_CREDENTIALS_FILE} (user: ${username}, pass: ${password}). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)
	100	+ // Deliberately NOT logging the password: deploy output lands in CI logs,
	101	+ // terminal scrollback and the systemd journal, all of which outlive the
	102	+ // deploy and are readable by more people than the 0600 file is.
	103	+ logger.info(`Management dashboard: generated a password for '${username}' and saved it to ${DASHBOARD_CREDENTIALS_FILE} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)
101	104	}
102	105	catch (error: any) {
103		- logger.warn(`Management dashboard: could not persist the generated password (${error?.message ?? error}). Using it for this deploy only — pass: ${password}`)
	106	+ // Only place the password is still printed: persisting failed, so this log
	107	+ // line is the operator's single copy. Say plainly that it is now in the log
	108	+ // so they can rotate it once the underlying write problem is fixed.
	109	+ logger.warn(`Management dashboard: could not persist the generated password (${error?.message ?? error}). Using it for this deploy only — pass: ${password}\nThis password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${DASHBOARD_CREDENTIALS_FILE} is writable.`)
104	110	}
105	111	return { password, source: 'generated' }
106	112	}