xmpp_cert_sync: push asxp.io and xmpp.asxp.io as separate files

Traefik never requests a certificate for a name it already holds one
for, so the XMPP certificate came out without asxp.io, the XMPP domain
itself. ejabberd picks the matching certificate file per domain, so push
two: the site's asxp.io certificate and xmpp.asxp.io + conference.
The receiver takes the name from the SSH command (asxp.io or a
subdomain), checks the certificate matches it, and retires the
hand-made server.pem once both files are in place.

A second probe on 5223 sends SNI asxp.io, as clients do, and the
outdated-certificate alert compares each served certificate with its
source in acme.json.

Assisted-by: Claude:opus-5-5

ansible/roles/monitoring/defaults/main.yaml

@@ -20,6 +20,7 @@ monitoring_probes:
   # so a STARTTLS dialogue times out: plain connect here, TLS on 5223.
   - { name: xmpp c2s, target: "xmpp.asxp.io:5222", module: tcp_connect }
   - { name: xmpp c2s tls, target: "xmpp.asxp.io:5223", module: tls_connect }
+  - { name: xmpp c2s tls asxp.io, target: "xmpp.asxp.io:5223", module: tls_connect_asxpio }
   - { name: xmpp s2s, target: "xmpp.asxp.io:5269", module: tcp_connect }
   - { name: turn, target: "xmpp.asxp.io:3478", module: tcp_connect }
   - { name: xray, target: "{{ hostvars['asxpio-services'].public_ip }}:443", module: tcp_connect }

ansible/roles/monitoring/templates/alert-rules.yaml.j2

@@ -174,7 +174,7 @@ groups:
           - refId: A
             relativeTimeRange: { from: 900, to: 0 }
             datasourceUid: prometheus
-            model: { refId: A, expr: "(max(xmpp_cert_source_not_after_timestamp_seconds) - min(probe_ssl_earliest_cert_expiry{instance=\"xmpp.asxp.io:5223\"})) / 86400", instant: true, intervalMs: 30000, maxDataPoints: 43200 }
+            model: { refId: A, expr: "((max(xmpp_cert_source_not_after_timestamp_seconds{cert=\"asxp.io\"}) - min(probe_ssl_earliest_cert_expiry{probe=\"xmpp c2s tls asxp.io\"})) / 86400 > 1) or ((max(xmpp_cert_source_not_after_timestamp_seconds{cert=\"xmpp.asxp.io\"}) - min(probe_ssl_earliest_cert_expiry{probe=\"xmpp c2s tls\"})) / 86400 > 1)", instant: true, intervalMs: 30000, maxDataPoints: 43200 }
           - refId: C
             datasourceUid: __expr__
             model: { refId: C, type: threshold, expression: A, conditions: [ { evaluator: { type: gt, params: [1] } } ] }

ansible/roles/monitoring/templates/blackbox.yml.j2

@@ -19,6 +19,15 @@ modules:
     tcp:
       preferred_ip_protocol: ip4
       tls: true
+  # XMPP clients name the XMPP domain (asxp.io), not the SRV host, in SNI
+  tls_connect_asxpio:
+    prober: tcp
+    timeout: 10s
+    tcp:
+      preferred_ip_protocol: ip4
+      tls: true
+      tls_config:
+        server_name: asxp.io
   tcp_connect:
     prober: tcp
     timeout: 10s