feat: split caddy report tls-internal into raw, computed, and global

The bare `tls-internal` key previously returned the computed value, so external tooling could not tell whether the property had been set on the app or was merely defaulting to `false`. The property is now also configurable with `--global`, the report exposes `computed-tls-internal` and `global-tls-internal` keys alongside the bare raw key, and the deploy path honors the per-app value with a fallback to the global value before the built-in default. Closes #8625.

plugins/caddy-vhosts/command-functions

@@ -70,6 +70,7 @@ cmd-caddy-report-single() {
   local flag_map=()
   if [[ "$APP" == "--global" ]]; then
     flag_map=(
+      "--caddy-global-tls-internal: $(fn-caddy-global-tls-internal)"
       "--caddy-image: $(fn-caddy-image)"
       "--caddy-letsencrypt-email: $(fn-caddy-letsencrypt-email)"
       "--caddy-letsencrypt-server: $(fn-caddy-letsencrypt-server)"
@@ -79,6 +80,8 @@ cmd-caddy-report-single() {
   else
     verify_app_name "$APP"
     flag_map=(
+      "--caddy-computed-tls-internal: $(fn-caddy-computed-tls-internal "$APP")"
+      "--caddy-global-tls-internal: $(fn-caddy-global-tls-internal)"
       "--caddy-image: $(fn-caddy-image)"
       "--caddy-letsencrypt-email: $(fn-caddy-letsencrypt-email)"
       "--caddy-letsencrypt-server: $(fn-caddy-letsencrypt-server)"

plugins/caddy-vhosts/core-post-deploy

@@ -14,7 +14,7 @@ trigger-caddy-vhosts-core-post-deploy() {
     return
   fi
 
-  tls_internal="$(fn-caddy-tls-internal)"
+  tls_internal="$(fn-caddy-computed-tls-internal "$APP")"
   dokku_log_info1 "Routing app via caddy"
   if [[ "$tls_internal" == "true" ]]; then
     dokku_log_warn "Warning: using caddy's internal, locally-trusted CA to produce certificates for this site"

plugins/caddy-vhosts/docker-args-process-deploy

@@ -88,7 +88,7 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
   # prefer the https:443 mapping to http:80 mapping
   if [[ -n "$is_app_listening" ]] && [[ -n "$caddy_domains" ]]; then
     has_443_mapping=false
-    tls_internal="$(fn-caddy-tls-internal)"
+    tls_internal="$(fn-caddy-computed-tls-internal "$APP")"
     if [[ -n "$proxy_container_https_port" ]] || [[ -n "$proxy_container_https_port_candidate" ]]; then
       has_443_mapping=true
     fi

plugins/caddy-vhosts/help-functions

@@ -28,7 +28,7 @@ fn-help-content() {
   declare desc="return help content"
   cat <<help_content
     caddy:report [<app>] [<flag>], Displays an caddy report for one or more apps
-    caddy:set <app> <property> (<value>), Set or clear an caddy property for an app
+    caddy:set [<app>|--global] <property> (<value>), Set or clear an caddy property for an app or globally
     caddy:show-config <app>, Display caddy compose config
     caddy:labels:add <app> <label> <value>, Add a label to an caddy app
     caddy:labels:remove <app> <label>, Remove a label from an caddy app

plugins/caddy-vhosts/internal-functions

@@ -69,5 +69,19 @@ fn-caddy-polling-interval() {
 
 fn-caddy-tls-internal() {
   declare APP="$1"
-  fn-plugin-property-get-default "caddy" "$APP" "tls-internal" "false"
+  fn-plugin-property-get-default "caddy" "$APP" "tls-internal" ""
+}
+
+fn-caddy-computed-tls-internal() {
+  declare APP="$1"
+  local value
+  value="$(fn-caddy-tls-internal "$APP")"
+  if [[ -z "$value" ]]; then
+    value="$(fn-caddy-global-tls-internal)"
+  fi
+  echo "$value"
+}
+
+fn-caddy-global-tls-internal() {
+  fn-plugin-property-get-default "caddy" "--global" "tls-internal" "false"
 }

plugins/caddy-vhosts/subcommands/set

@@ -10,7 +10,7 @@ cmd-caddy-set() {
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1" KEY="$2" VALUE="$3"
   local VALID_KEYS=("image" "letsencrypt-email" "letsencrypt-server" "log-level" "polling-interval" "tls-internal")
-  local GLOBAL_KEYS=("image" "letsencrypt-email" "letsencrypt-server" "log-level" "polling-interval")
+  local GLOBAL_KEYS=("image" "letsencrypt-email" "letsencrypt-server" "log-level" "polling-interval" "tls-internal")
   local GLOBAL_ONLY_KEYS=("image" "letsencrypt-email" "letsencrypt-server" "log-level" "polling-interval")
 
   [[ -z "$KEY" ]] && dokku_log_fail "No key specified"