appmgr: bugfix: use fullchain cert

appmgr/src/nginx-standard.conf.template

@@ -1,7 +1,7 @@
 server {{
     listen 443 ssl;
     server_name {hostname}.local;
-    ssl_certificate /root/appmgr/apps/{app_id}/cert-local.crt.pem;
+    ssl_certificate /root/appmgr/apps/{app_id}/cert-local.fullchain.crt.pem;
     ssl_certificate_key /root/appmgr/apps/{app_id}/cert-local.key.pem;
     location / {{
         proxy_pass http://{app_ip}:{internal_port}/;

appmgr/src/tor.rs

@@ -302,6 +302,32 @@ pub async fn write_lan_services(hidden_services: &ServicesMap) -> Result<(), Err
                             .invoke("OpenSSL GenKey")
                             .await?;
                     }
+                    let fullchain_path = base_path.join("cert-local.fullchain.crt.pem");
+                    if !fullchain_path.exists().await {
+                        let mut fullchain_file = fullchain_path.write(None).await?;
+                        tokio::io::copy(
+                            &mut tokio::fs::File::open(&cert_path).await?,
+                            &mut *fullchain_file,
+                        )
+                        .await?;
+                        tokio::io::copy(
+                            &mut tokio::fs::File::open(
+                                "/root/agent/ca/intermediate/certs/embassy-int-ca.crt.pem",
+                            )
+                            .await?,
+                            &mut *fullchain_file,
+                        )
+                        .await?;
+                        tokio::io::copy(
+                            &mut tokio::fs::File::open(
+                                "/root/agent/ca/certs/embassy-int-ca.crt.pem",
+                            )
+                            .await?,
+                            &mut *fullchain_file,
+                        )
+                        .await?;
+                        fullchain_file.commit().await?;
+                    }
                     f.write_all(
                         format!(
                             include_str!("nginx-standard.conf.template"),

appmgr/src/util.rs

@@ -137,6 +137,7 @@ impl PersistenceFile {
         if let Some(mut file) = self.file.take() {
             file.flush().await?;
             file.shutdown().await?;
+            file.sync_all().await?;
             drop(file);
         }
         if let Some(path) = self.needs_commit.take() {