fix(api): share base-domain API host

Tenant subdomains route through api.<base-domain>; nginx forwards the exact storefront host derived from the validated browser origin.

.github/workflows/deploy.yml

@@ -103,11 +103,26 @@ jobs:
             echo "BACKEND_UPSTREAM is invalid" >&2; exit 1;
           }
 
-          SSH="ssh -i ~/.ssh/deploy_key -o BatchMode=yes"
-          for domain in $STOREFRONT_DOMAINS; do
-            [[ "$domain" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$ ]] || {
-              echo "invalid storefront domain: $domain" >&2; exit 1;
+          declare -A API_BASE_DOMAINS=()
+          for storefront in $STOREFRONT_DOMAINS; do
+            [[ "$storefront" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$ ]] || {
+              echo "invalid storefront domain: $storefront" >&2; exit 1;
             }
+            IFS=. read -ra labels <<< "$storefront"
+            label_count=${#labels[@]}
+            take=2
+            tld=${labels[label_count-1]}
+            second_level=${labels[label_count-2]}
+            if (( label_count >= 3 && ${#tld} == 2 && ${#second_level} <= 3 )); then
+              take=3
+            fi
+            start=$((label_count - take))
+            base_domain=$(IFS=.; echo "${labels[*]:start}")
+            API_BASE_DOMAINS["$base_domain"]=1
+          done
+
+          SSH="ssh -i ~/.ssh/deploy_key -o BatchMode=yes"
+          for domain in "${!API_BASE_DOMAINS[@]}"; do
             $SSH "$USER@$HOST" sudo /usr/local/sbin/marketplaces-configure-api-domain \
               --domain "$domain" --email "$CERTBOT_EMAIL" --upstream "$BACKEND_UPSTREAM"
           done