From 00ea8af1e10e82cd2d1fa8928e3dfb174e1af3fa Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 25 Aug 2026 20:54:20 +1000 Subject: [PATCH] cheeztv: manage the LE *.unkin.net wildcard centrally, reflect into cheeztv Per review, the *.unkin.net Let's Encrypt wildcard is no longer minted per-namespace. A single Certificate (wildcard-unkin-net) now lives in the cert-manager namespace and carries emberstack reflector source annotations via spec.secretTemplate.annotations, so its secret (wildcard-unkin-net-tls) is auto-reflected into consumer namespaces. Future consumers are added by appending to the comma-separated reflection-*-namespaces lists. Drop apps/base/cheeztv/certificate.yaml and its kustomization entry, and point the public cheeztv gateway https listener at the reflected wildcard-unkin-net-tls secret. cheeztv-internal keeps its Vault PKI leaf. --- .../certificate_wildcard-unkin-net.yaml | 27 +++++++++++++++++++ apps/base/cert-manager/kustomization.yaml | 1 + apps/base/cheeztv/certificate.yaml | 21 --------------- apps/base/cheeztv/gateway.yaml | 8 +++--- apps/base/cheeztv/kustomization.yaml | 1 - 5 files changed, 33 insertions(+), 25 deletions(-) create mode 100644 apps/base/cert-manager/certificate_wildcard-unkin-net.yaml delete mode 100644 apps/base/cheeztv/certificate.yaml diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml new file mode 100644 index 0000000..c9cc74c --- /dev/null +++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml @@ -0,0 +1,27 @@ +--- +# Single, centrally-managed Let's Encrypt *.unkin.net wildcard. DNS-01 validates +# once against the delegated _acme-challenge.unkin.net CNAME, so consumers get a +# real public leaf without per-host challenge records. The minted secret carries +# emberstack reflector annotations (via secretTemplate) so it is auto-reflected +# into consumer namespaces; append future consumers to the *-namespaces lists. +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-unkin-net + namespace: cert-manager +spec: + secretName: wildcard-unkin-net-tls + secretTemplate: + annotations: + reflector.v1.k8s.emberstack.com/reflection-allowed: "true" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv" + reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv" + privateKey: + size: 4096 + dnsNames: + - "*.unkin.net" + issuerRef: + name: letsencrypt + kind: ClusterIssuer + group: cert-manager.io diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml index 934cbc2..a102d8c 100644 --- a/apps/base/cert-manager/kustomization.yaml +++ b/apps/base/cert-manager/kustomization.yaml @@ -11,3 +11,4 @@ resources: - vmservicescrape.yaml - clusterissuer_letsencrypt.yaml - clusterissuer_letsencrypt-staging.yaml + - certificate_wildcard-unkin-net.yaml diff --git a/apps/base/cheeztv/certificate.yaml b/apps/base/cheeztv/certificate.yaml deleted file mode 100644 index 9ddf2aa..0000000 --- a/apps/base/cheeztv/certificate.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# Public-facing cheeztv.unkin.net terminates TLS with a real Let's Encrypt cert -# instead of the internal Vault PKI leaf. A single *.unkin.net wildcard is used -# so DNS-01 validates against the one delegated _acme-challenge.unkin.net CNAME -# and no per-host _acme-challenge records are required. The cheeztv gateway's -# https listener consumes this secret; cheeztv-internal keeps its Vault leaf. -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: cheeztv-wildcard-tls - namespace: cheeztv -spec: - secretName: cheeztv-wildcard-tls - privateKey: - size: 4096 - dnsNames: - - "*.unkin.net" - issuerRef: - name: letsencrypt - kind: ClusterIssuer - group: cert-manager.io diff --git a/apps/base/cheeztv/gateway.yaml b/apps/base/cheeztv/gateway.yaml index 43f8fed..6a4b834 100644 --- a/apps/base/cheeztv/gateway.yaml +++ b/apps/base/cheeztv/gateway.yaml @@ -2,8 +2,10 @@ # Friendly public hostname for the kids instance, cheeztv.unkin.net. Same # internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns # publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is -# terminated with the real Let's Encrypt *.unkin.net wildcard from -# certificate.yaml (secret cheeztv-wildcard-tls), not the Vault PKI issuer. +# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted +# once in the cert-manager namespace (Certificate wildcard-unkin-net) and +# reflected into this namespace by the emberstack reflector as the secret +# wildcard-unkin-net-tls, not the Vault PKI issuer. apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: @@ -35,7 +37,7 @@ spec: certificateRefs: - group: "" kind: Secret - name: cheeztv-wildcard-tls + name: wildcard-unkin-net-tls mode: Terminate --- # Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net diff --git a/apps/base/cheeztv/kustomization.yaml b/apps/base/cheeztv/kustomization.yaml index 737c7d2..26efe34 100644 --- a/apps/base/cheeztv/kustomization.yaml +++ b/apps/base/cheeztv/kustomization.yaml @@ -22,6 +22,5 @@ resources: - service.yaml - valkey.yaml - vmpodscrape.yaml - - certificate.yaml - gateway.yaml - httproute.yaml