nginx-util: support wildcard ssl certificate

Maintainer: @peter-stadler
Environment: OpenWrt 21.02.0 r16279-5cc0535800 x86/64

Description:

I use nginx for luci with a top domain example.com:

➜  ~ uci get nginx._lan.server_name
example.com

and a subsite foo.example.com configured in /etc/nginx/conf.d/foo.example.com.conf like this:

server {
    server_name foo.example.com;
    ...
}

I also apply for a Let's Encrypt wildcard certificate to cover the above domains:

➜  ~ cat /etc/config/acme 
...
config cert 'example'
        list domains 'example.com'
        list domains '*.example.com'
...

acmebot is set to automatically update nginx config.

After the cert is successfully issued, the example.com config can be correctly updated, while foo.example.com cannot:

Sun Oct 17 07:49:30 2021 daemon.info run-acme[7437]: Your cert is in: /etc/acme/example.com/example.com.cer
Sun Oct 17 07:49:30 2021 daemon.info run-acme[7437]: Your cert key is in: /etc/acme/example.com/example.com.key
Sun Oct 17 07:49:31 2021 daemon.info run-acme[7437]: The intermediate CA cert is in: /etc/acme/example.com/ca.cer
Sun Oct 17 07:49:31 2021 daemon.info run-acme[7437]: And the full chain certs is there: /etc/acme/example.com/fullchain.cer
Sun Oct 17 07:49:31 2021 daemon.info run-acme[7437]: /usr/bin/nginx-util
Sun Oct 17 07:49:31 2021 daemon.err run-acme[7437]: Adding SSL directives to UCI server: nginx._lan
Sun Oct 17 07:49:31 2021 daemon.err run-acme[7437]: 	uci_manage_ssl='acme'
Sun Oct 17 07:49:31 2021 daemon.err run-acme[7437]: 	ssl_certificate='/etc/acme/example.com/fullchain.cer'
Sun Oct 17 07:49:31 2021 daemon.err run-acme[7437]: 	ssl_certificate_key='/etc/acme/example.com/example.com.key'
Sun Oct 17 07:49:31 2021 daemon.err run-acme[7437]:  * nginx-util lookup error: neither there is a file named '/etc/nginx/conf.d/*.example.com.conf' nor the UCI config has a nginx server with section name or 'server_name': *.example.com
Sun Oct 17 07:49:31 2021 daemon.info acme: Running post checks (cleanup).

It turns out that the wildcard *.example.com was not applied to all matched servers but treated as a normal server name instead by nginx-util.

Start by tracing the nginx-util entry point that handles the ACME certificate paths and UCI server lookup, using the reported /etc/nginx/conf.d/*.example.com.conf case as the reproduction. Check how wildcard domains are matched against configured servers. Done means a wildcard certificate is applied to matching servers rather than treated as a literal server name.