Manage SSL and domains with OpenCode on xCloud

OpenCode runs in the directory of the project, and that is useful for certificate work because the domain you are asking about is usually written down somewhere in the repository: an APP_URL in an env example, a server_name in a config file, a CNAME file, a README. You can say check SSL for the domain in this repo and OpenCode will read the file, pick out the hostname and then ask xCloud about it. Every xCloud tool shows up with the xcloud_ prefix, so the calls you will see in the session are names such as xcloud_sites_ssl, xcloud_sites_sslCertificates and xcloud_servers_dns_check. They are reads, and they run straight away.

A typical session starts with a question, not a change. You type is the certificate on example.com healthy, and OpenCode resolves the site by domain, reads its SSL state and the list of certificates, and prints the provider, the status and the expiry date in two or three lines. If you are waiting on a new domain, you ask whether DNS points at the server yet. Each DNS check is one lookup, so OpenCode repeats it every so often and reports when the record finally resolves, and it tells you separately when the record sits behind Cloudflare's proxy. Only then does it offer to install a certificate. It names the site and the provider, waits for your yes, sends the install or renewal, and polls the certificate status until it settles instead of trusting the first success message. It finishes by fetching the HTTPS URL.

The edges are worth knowing. A normal renewal does nothing until the certificate is within seven days of expiry, so OpenCode will say so and offer a forced renewal rather than pretend it worked. If you ask it to add a second domain to a live site, it will not attempt a workaround: it gives you the dashboard path, Site, then Domain, and the dashboard link xCloud returned. Because OpenCode lets you switch a server's tools on for one agent only, a small operations agent that can read certificates and nothing else is easy to set up.

OpenCode specific: If you allow the whole xcloud* pattern for an agent, OpenCode stops prompting you for any xCloud tool, including the ones that install, renew or delete a certificate. xCloud still stops those calls for an explicit confirmation, but allow only the read tools if you want OpenCode's own prompt as a second check. If you connected the compact profile or limited the toolsets, keep the ones that cover sites and certificates, or the agent will not see the SSL tools at all.