From f37749523dcb2f6c7bd129b54b5a10a507fceda1 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 16:38:31 +1000 Subject: [PATCH] Add *.main and *.ceph wildcard certificates for haproxy (#484) The haproxy edge terminates TLS for hosts under `main.unkin.net` and `ceph.unkin.net`, which the single `*.unkin.net` wildcard does not cover. - Add cert-manager Certificates for both wildcards from the `letsencrypt` ClusterIssuer. - Reflect the minted secrets into the `haproxy` namespace. Needs these records in the public unkin.net zone first: `_acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net.` `_acme-challenge.ceph.unkin.net. CNAME _acme-challenge.ceph.acme.unkin.net.` Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/484 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .../certificate_wildcard-ceph-unkin-net.yaml | 26 +++++++++++++++++++ .../certificate_wildcard-main-unkin-net.yaml | 26 +++++++++++++++++++ .../certificate_wildcard-unkin-net.yaml | 4 +-- apps/base/cert-manager/kustomization.yaml | 2 ++ 4 files changed, 56 insertions(+), 2 deletions(-) create mode 100644 apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml create mode 100644 apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml diff --git a/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml new file mode 100644 index 0000000..8eff22e --- /dev/null +++ b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml @@ -0,0 +1,26 @@ +--- +# Let's Encrypt *.ceph.unkin.net wildcard for the haproxy edge (ceph dashboard). +# DNS-01 needs the delegated _acme-challenge.ceph.unkin.net CNAME in the public +# unkin.net zone. +# _acme-challenge.ceph.unkin.net. CNAME _acme-challenge.ceph.acme.unkin.net. +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-ceph-unkin-net + namespace: cert-manager +spec: + secretName: wildcard-ceph-unkin-net-tls + secretTemplate: + annotations: + reflector.v1.k8s.emberstack.com/reflection-allowed: "true" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy" + reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy" + privateKey: + size: 4096 + dnsNames: + - "*.ceph.unkin.net" + issuerRef: + name: letsencrypt + kind: ClusterIssuer + group: cert-manager.io diff --git a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml new file mode 100644 index 0000000..bc34a2b --- /dev/null +++ b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml @@ -0,0 +1,26 @@ +--- +# Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack, +# jellyfin, stalwart webadmin/autoconfig). DNS-01 needs the delegated +# _acme-challenge.main.unkin.net CNAME in the public unkin.net zone. +# _acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net. +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-main-unkin-net + namespace: cert-manager +spec: + secretName: wildcard-main-unkin-net-tls + secretTemplate: + annotations: + reflector.v1.k8s.emberstack.com/reflection-allowed: "true" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy" + reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy" + privateKey: + size: 4096 + dnsNames: + - "*.main.unkin.net" + issuerRef: + name: letsencrypt + kind: ClusterIssuer + group: cert-manager.io diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml index d3b971c..7873433 100644 --- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml +++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml @@ -14,9 +14,9 @@ spec: secretTemplate: annotations: reflector.v1.k8s.emberstack.com/reflection-allowed: "true" - reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy" reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" - reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy" privateKey: size: 4096 dnsNames: diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml index a102d8c..592a976 100644 --- a/apps/base/cert-manager/kustomization.yaml +++ b/apps/base/cert-manager/kustomization.yaml @@ -12,3 +12,5 @@ resources: - clusterissuer_letsencrypt.yaml - clusterissuer_letsencrypt-staging.yaml - certificate_wildcard-unkin-net.yaml + - certificate_wildcard-main-unkin-net.yaml + - certificate_wildcard-ceph-unkin-net.yaml