feat: add full proxy configuration (Phase 8)

Implement three sub-phases of proxy configuration features:

8A - Service policy fields: CORS, IP access control, compression,
path rewrite, and redirect route type. Adds global compression and
access control to project config. Extends KDL generator with new
block types using a shared build_nested_map_block helper.

8B - Upstream groups with load balancing: new upstream_groups and
upstream_targets tables, schema, CRUD context functions, KDL
generation, REST API controller, and LiveView UI. Supports 6
algorithms (round_robin, least_conn, ip_hash, consistent_hash,
weighted, random), health checks, circuit breakers, sticky sessions.

8C - TLS certificate management: certificate storage with AES-256-GCM
encrypted private keys, X.509 PEM parsing for metadata extraction
(issuer, validity, fingerprint, SAN domains), Oban expiry worker,
REST API, LiveView UI, and KDL TLS block generation.

521 tests passing (36 new certificate + upstream group tests).

Author: raffaelschneider

lib/sentinel_cp/application.ex

@@ -28,6 +28,7 @@ defmodule SentinelCp.Application do
     # Start periodic workers
     SentinelCp.Rollouts.SchedulerWorker.ensure_started()
     SentinelCp.Nodes.DriftWorker.ensure_started()
+    SentinelCp.Services.CertificateExpiryWorker.ensure_started()
 
     result
   end

lib/sentinel_cp/services.ex

@@ -8,7 +8,7 @@ defmodule SentinelCp.Services do
 
   import Ecto.Query, warn: false
   alias SentinelCp.Repo
-  alias SentinelCp.Services.{Service, ProjectConfig}
+  alias SentinelCp.Services.{Service, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate}
 
   ## Services
 
@@ -116,4 +116,164 @@ defmodule SentinelCp.Services do
     |> ProjectConfig.changeset(attrs)
     |> Repo.update()
   end
+
+  ## Upstream Groups
+
+  @doc """
+  Lists upstream groups for a project, preloading targets.
+  """
+  def list_upstream_groups(project_id) do
+    from(g in UpstreamGroup,
+      where: g.project_id == ^project_id,
+      order_by: [asc: g.name],
+      preload: [:targets]
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  Gets a single upstream group by ID, preloading targets.
+  """
+  def get_upstream_group(id) do
+    UpstreamGroup
+    |> Repo.get(id)
+    |> Repo.preload(:targets)
+  end
+
+  @doc """
+  Gets a single upstream group by ID, raises if not found.
+  """
+  def get_upstream_group!(id) do
+    UpstreamGroup
+    |> Repo.get!(id)
+    |> Repo.preload(:targets)
+  end
+
+  @doc """
+  Creates an upstream group.
+  """
+  def create_upstream_group(attrs) do
+    %UpstreamGroup{}
+    |> UpstreamGroup.create_changeset(attrs)
+    |> Repo.insert()
+  end
+
+  @doc """
+  Updates an upstream group.
+  """
+  def update_upstream_group(%UpstreamGroup{} = group, attrs) do
+    group
+    |> UpstreamGroup.update_changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Deletes an upstream group.
+  """
+  def delete_upstream_group(%UpstreamGroup{} = group) do
+    Repo.delete(group)
+  end
+
+  @doc """
+  Adds a target to an upstream group.
+  """
+  def add_upstream_target(attrs) do
+    %UpstreamTarget{}
+    |> UpstreamTarget.changeset(attrs)
+    |> Repo.insert()
+  end
+
+  @doc """
+  Updates an upstream target.
+  """
+  def update_upstream_target(%UpstreamTarget{} = target, attrs) do
+    target
+    |> UpstreamTarget.changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Gets an upstream target by ID.
+  """
+  def get_upstream_target(id), do: Repo.get(UpstreamTarget, id)
+
+  @doc """
+  Removes an upstream target.
+  """
+  def remove_upstream_target(%UpstreamTarget{} = target) do
+    Repo.delete(target)
+  end
+
+  ## Certificates
+
+  @doc """
+  Lists certificates for a project, ordered by domain.
+  """
+  def list_certificates(project_id) do
+    from(c in Certificate,
+      where: c.project_id == ^project_id,
+      order_by: [asc: c.domain]
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  Gets a single certificate by ID.
+  """
+  def get_certificate(id), do: Repo.get(Certificate, id)
+
+  @doc """
+  Gets a single certificate by ID, raises if not found.
+  """
+  def get_certificate!(id), do: Repo.get!(Certificate, id)
+
+  @doc """
+  Creates a certificate. Expects `key_pem` (plaintext) in attrs — it will be encrypted.
+  """
+  def create_certificate(attrs) do
+    %Certificate{}
+    |> Certificate.create_changeset(attrs)
+    |> Repo.insert()
+  end
+
+  @doc """
+  Updates a certificate (name, auto_renew, acme_config).
+  """
+  def update_certificate(%Certificate{} = cert, attrs) do
+    cert
+    |> Certificate.update_changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Renews a certificate with new PEM data.
+  """
+  def renew_certificate(%Certificate{} = cert, attrs) do
+    cert
+    |> Certificate.renew_changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Deletes a certificate.
+  """
+  def delete_certificate(%Certificate{} = cert) do
+    Repo.delete(cert)
+  end
+
+  @doc """
+  Lists certificates expiring within the given number of days.
+  """
+  def list_expiring_certificates(days_ahead \\ 30) do
+    now = DateTime.utc_now()
+    threshold = DateTime.add(now, days_ahead * 86_400, :second)
+
+    from(c in Certificate,
+      where: c.status in ["active", "expiring_soon"],
+      where: c.not_after > ^now,
+      where: c.not_after <= ^threshold,
+      order_by: [asc: c.not_after]
+    )
+    |> Repo.all()
+  end
 end