From ae3edd9db5a1ca9175440303ee1f65d5c58b7e0f Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 14:09:56 +1000 Subject: [PATCH 1/2] add *.main.unkin.net and *.ceph.unkin.net wildcard certificates --- .../certificate_wildcard-ceph-unkin-net.yaml | 25 +++++++++++++++++++ .../certificate_wildcard-main-unkin-net.yaml | 25 +++++++++++++++++++ .../certificate_wildcard-unkin-net.yaml | 4 +-- apps/base/cert-manager/kustomization.yaml | 2 ++ 4 files changed, 54 insertions(+), 2 deletions(-) create mode 100644 apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml create mode 100644 apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml diff --git a/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml new file mode 100644 index 0000000..dbc780f --- /dev/null +++ b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml @@ -0,0 +1,25 @@ +--- +# Let's Encrypt *.ceph.unkin.net wildcard for the haproxy edge (ceph dashboard). +# DNS-01 needs the delegated _acme-challenge.ceph.unkin.net CNAME in the public +# unkin.net zone. +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-ceph-unkin-net + namespace: cert-manager +spec: + secretName: wildcard-ceph-unkin-net-tls + secretTemplate: + annotations: + reflector.v1.k8s.emberstack.com/reflection-allowed: "true" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy" + reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy" + privateKey: + size: 4096 + dnsNames: + - "*.ceph.unkin.net" + issuerRef: + name: letsencrypt + kind: ClusterIssuer + group: cert-manager.io diff --git a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml new file mode 100644 index 0000000..ba8f76c --- /dev/null +++ b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml @@ -0,0 +1,25 @@ +--- +# Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack, +# jellyfin, stalwart webadmin/autoconfig). DNS-01 needs the delegated +# _acme-challenge.main.unkin.net CNAME in the public unkin.net zone. +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-main-unkin-net + namespace: cert-manager +spec: + secretName: wildcard-main-unkin-net-tls + secretTemplate: + annotations: + reflector.v1.k8s.emberstack.com/reflection-allowed: "true" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy" + reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy" + privateKey: + size: 4096 + dnsNames: + - "*.main.unkin.net" + issuerRef: + name: letsencrypt + kind: ClusterIssuer + group: cert-manager.io diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml index d3b971c..7873433 100644 --- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml +++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml @@ -14,9 +14,9 @@ spec: secretTemplate: annotations: reflector.v1.k8s.emberstack.com/reflection-allowed: "true" - reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy" reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" - reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy" privateKey: size: 4096 dnsNames: diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml index a102d8c..592a976 100644 --- a/apps/base/cert-manager/kustomization.yaml +++ b/apps/base/cert-manager/kustomization.yaml @@ -12,3 +12,5 @@ resources: - clusterissuer_letsencrypt.yaml - clusterissuer_letsencrypt-staging.yaml - certificate_wildcard-unkin-net.yaml + - certificate_wildcard-main-unkin-net.yaml + - certificate_wildcard-ceph-unkin-net.yaml -- 2.47.3 From 4cf3b59308fc7ddd7b5a6817549631b89aec2d27 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 14:32:14 +1000 Subject: [PATCH 2/2] name the acme.unkin.net CNAME targets in the wildcard cert comments --- apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml | 1 + apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml index dbc780f..8eff22e 100644 --- a/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml +++ b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml @@ -2,6 +2,7 @@ # Let's Encrypt *.ceph.unkin.net wildcard for the haproxy edge (ceph dashboard). # DNS-01 needs the delegated _acme-challenge.ceph.unkin.net CNAME in the public # unkin.net zone. +# _acme-challenge.ceph.unkin.net. CNAME _acme-challenge.ceph.acme.unkin.net. apiVersion: cert-manager.io/v1 kind: Certificate metadata: diff --git a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml index ba8f76c..bc34a2b 100644 --- a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml +++ b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml @@ -2,6 +2,7 @@ # Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack, # jellyfin, stalwart webadmin/autoconfig). DNS-01 needs the delegated # _acme-challenge.main.unkin.net CNAME in the public unkin.net zone. +# _acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net. apiVersion: cert-manager.io/v1 kind: Certificate metadata: -- 2.47.3