Mukul SharmaandClaude Opus 5
adb514c3be
The deployment has a domain of its own now, which is the first time a public certificate has been possible here at all. The registry issuer beside this one explains why: nip.io is not on the public suffix list and every *.nip.io certificate shares one rate limit, so Let's Encrypt could never serve the addresses this cluster has been using. DNS-01 rather than HTTP-01, because every deployed app lives at <app>.apps.<domain> and only a DNS-01 challenge can issue the wildcard that covers all of them. HTTP-01 would mean a certificate per app, requested the moment each one is created. Two issuers, staging and production. Production allows five duplicate certificates a week and a failing solver spends that allowance without issuing anything, which can lock a domain out of certificates for days. Staging has no meaningful limit and issues from an untrusted root, so a browser warning is the signal that the plumbing works. Move to the production issuer once a staging certificate appears. The token reaches cert-manager the same way every other credential here does: Vault, through External Secrets. It wants Zone -> DNS -> Edit on the one zone and nothing else — enough to write the TXT record a challenge needs, and no more. Until `vault kv put secret/cloudflare/dns-token` has run, the ExternalSecret stays unfulfilled and the issuers cannot register. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
73 lines
2.9 KiB
YAML
73 lines
2.9 KiB
YAML
# The issuer for this deployment's public certificates, from Let's Encrypt.
|
|
#
|
|
# Two of them: staging first, production second. Let's Encrypt's production
|
|
# endpoint allows five duplicate certificates per week and a failed solver
|
|
# burns that allowance without issuing anything, so a misconfiguration can
|
|
# lock the real domain out of certificates for days. The staging endpoint
|
|
# has no meaningful limit and issues from an untrusted root — a browser will
|
|
# warn, which is exactly what proves the plumbing works before anything
|
|
# depends on it.
|
|
#
|
|
# DNS-01, not HTTP-01, because every deployed app lives at
|
|
# <app>.apps.<domain> and only a DNS-01 challenge can issue the wildcard
|
|
# that covers all of them. HTTP-01 would need a certificate per app,
|
|
# requested the moment each one is created.
|
|
#
|
|
# This is what a real domain buys. The registry issuer beside this file
|
|
# explains why nip.io could never have it: nip.io is not on the public
|
|
# suffix list, and every *.nip.io certificate shares one rate limit.
|
|
#
|
|
# BEFORE THIS WORKS, three things must be true:
|
|
#
|
|
# 1. The zone's records point straight at the load balancer, NOT through
|
|
# Cloudflare's proxy. A proxied record answers from Cloudflare's own
|
|
# addresses, so the certificate would protect traffic that never
|
|
# reaches this cluster.
|
|
# 2. The `cloudflare-api-token` Secret exists in the cert-manager
|
|
# namespace, created by Terraform from var.cloudflare_api_token. Its
|
|
# key must be `api-token`; cert-manager reports a mismatch only when a
|
|
# challenge fails, long after everything else looked fine.
|
|
# 3. The email below is filled in. Let's Encrypt requires one for expiry
|
|
# notices, and leaving the placeholder makes registration fail.
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-staging
|
|
spec:
|
|
acme:
|
|
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
# REPLACE ME — Let's Encrypt registers this address and sends expiry
|
|
# warnings to it. It is given to a third party, so it is deliberately
|
|
# not filled in from anyone's account details.
|
|
email: mukul.sharma909.ms@gmail.com
|
|
privateKeySecretRef:
|
|
# cert-manager's own ACME account key, which it creates. Nothing
|
|
# supplies this; it must differ between the two issuers or they share
|
|
# an account registration across two different endpoints.
|
|
name: letsencrypt-staging-account-key
|
|
solvers:
|
|
- dns01:
|
|
cloudflare:
|
|
apiTokenSecretRef:
|
|
name: cloudflare-api-token
|
|
key: api-token
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
# REPLACE ME — see above.
|
|
email: mukul.sharma909.ms@gmail.com
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod-account-key
|
|
solvers:
|
|
- dns01:
|
|
cloudflare:
|
|
apiTokenSecretRef:
|
|
name: cloudflare-api-token
|
|
key: api-token
|