Fix cert deletion key and harden nginx SSL/redis handling

- host.remove() now deletes the cert under the host key instead of the
  Domain relation object, so certs are actually removed from redis
- targetinfo.lua returns the redis connection to the pool via
  set_keepalive instead of leaking one connection per request
- autossl.conf drops TLSv1/1.1 and 3DES, adds TLSv1.3

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/models/host.js

@@ -22,14 +22,18 @@ class Host extends Table{
 		'created_on': {default: function(){return (new Date).getTime()}},
 		'updated_by': {default:"__NONE__", isRequired: false, type: 'string',},
 		'updated_on': {default: function(){return (new Date).getTime()}, always: true},
+
 		'host': {isRequired: true, type: 'string', min: 3, max: 500},
 		'ip': {isRequired: true, type: 'string', min: 3, max: 500},
 		'targetPort': {isRequired: true, type: 'number', min:0, max:65535},
 		'forcessl': {isRequired: false, default: true, type: 'boolean'},
 		'targetssl': {isRequired: false, default: false, type: 'boolean'},
+
 		'is_cache': {default: false, isRequired: false, type: 'boolean',},
+		
 		'is_wildcard': {default: false, isRequired: false, type: 'boolean',},
 		'wildcard_status': {isRequired: false, type: 'string', min: 3, max: 500},
+		'wildcard_matchAny': {default: false, isRequired: false, type: 'boolean',},
 		'wildcard_parent': {isRequired: false, type: 'string', min: 3, max: 500},
 		'wildcard_expires': {isRequired: false, type: 'number'},
 		'domain': {model: 'Domain', rel: 'one'},
@@ -85,9 +89,9 @@ class Host extends Table{
 		try{
 			// Validate requested host is valid host and domain
 			if(data.challengeType === 'DNS-01-wildcard'){
+				await this.validateWildcardCreate(data, args);
 				data.is_wildcard = true;
 				data.wildcard_status = "Starting"
-				await this.validateWildcardCreate(data, args);
 			}
 
 			// Validate requested host has a valid wildcard parent
@@ -272,7 +276,7 @@ class Host extends Table{
 			let out = await super.remove(...args);
 			await Host.buildLookUpObj();
 			await this.bustCache(this.host);
-			await deleteCert(this.domain);
+			await deleteCert(this.host);
 
 			return out;
 		} catch(error){

ops/nginx_conf/autossl.conf

@@ -1,9 +1,9 @@
 listen 443 ssl http2;
 listen 4443 ssl;
 
-ssl_protocols     TLSv1 TLSv1.1 TLSv1.2;
+ssl_protocols     TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers  on;
-ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!3DES:!MD5;
 
 ssl_certificate_by_lua_block {
     auto_ssl:ssl_certificate()

ops/nginx_conf/targetinfo.lua

@@ -37,6 +37,14 @@ function M.get(ngx, domain, targetInfo)
     local res, err = red:hgetall("proxy_Host_"..domain)
     res = red:array_to_hash(res)
 
+    -- Return the connection to the pool instead of closing it, so it can be
+    -- reused by later requests. Without this a new connection is opened per
+    -- request and never released, exhausting sockets under load.
+    local ok, err = red:set_keepalive(10000, 100)
+    if not ok then
+        ngx.log(ngx.ERR, "failed to set redis keepalive: ", err)
+    end
+
     if not res["ip"] then
         if connect("/var/run/proxy_lookup.socket") then 
             local socket = require("socket.unix")()