fix(migration): don't reclassify custom ssl sites as letsencrypt

[mrrobot47]

Problem

The 20250927101545_..._fix_ssl_flag_for_existing_le_certs migration auto-sets site_ssl = 'le' for sites that have LE-looking cert files on disk and a Let's Encrypt issuer. Its gate empty( $db_ssl ) || $db_ssl !== 'le' matches any non-le site — including ones explicitly created with --ssl=custom (also self/inherit). A custom site using a Let's Encrypt-issued cert (with a .chain.pem present) would be silently reclassified to le and pulled into automatic LE renewal that can overwrite or break the user's certificate.

Fix

Narrow the gate to null === $db_ssl || '' === $db_ssl — repair only sites whose SSL flag is genuinely unset (the migration's intent). Explicit custom/self/inherit (and le) choices are never overridden, and neither is '0', the value ee site update --ssl=off stores (empty() would still have matched it and turned SSL back on in the DB for a site serving plain HTTP). down() remains a no-op (forward-only). The boolean change preserves the un-flagged-LE repair case and removes only the unwanted override (the old || $db_ssl !== 'le' half was already redundant for the le case).

Note

A site whose flag was explicitly set to a wrong non-empty value will no longer be auto-corrected — an intentional, conservative trade-off: a data migration should not override an explicit user choice.

This migration shipped in site-command v3.6.0, and a migration runs only once per install, so this change only affects installs upgrading from a version older than v3.6.0. Sites already reclassified on existing installs stay le (their original flag is recorded in /opt/easyengine/.backup/.ssl-fix.log); repairing them would need a new forward migration.

Testing

Tested on Ubuntu 26.04 with EasyEngine 4.12.0 by re-running the migration against custom, self-signed, SSL-off ('0'), NULL and empty-flag sites, each with a cert whose issuer contains "Let's Encrypt" plus a chain file: only the NULL and empty-flag sites are set to le; the others keep their flag.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.