unkin-agent
d42d013541
why: cheeztv.unkin.net needs a publicly-trusted cert; DNS-01 via the delegated acme.unkin.net zone is now working (staging wildcard verified end-to-end in ~70s). A single centrally-managed wildcard avoids per-host CNAMEs and LE duplicate-order rate limits. - add Certificate wildcard-unkin-net (cert-manager ns, ClusterIssuer letsencrypt prod, secret wildcard-unkin-net-tls) with emberstack reflector secretTemplate annotations - reflect the secret into the cheeztv namespace (append future consumers to the two reflector namespace lists) - point the public cheeztv gateway listener at wildcard-unkin-net-tls and drop its vault-issuer annotations (cheeztv-internal stays on vault-issuer) Reviewed-on: #417 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
28 lines
1.0 KiB
YAML
28 lines
1.0 KiB
YAML
---
|
|
# Single, centrally-managed Let's Encrypt *.unkin.net wildcard. DNS-01 validates
|
|
# once against the delegated _acme-challenge.unkin.net CNAME, so consumers get a
|
|
# real public leaf without per-host challenge records. The minted secret carries
|
|
# emberstack reflector annotations (via secretTemplate) so it is auto-reflected
|
|
# into consumer namespaces; append future consumers to the *-namespaces lists.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: wildcard-unkin-net
|
|
namespace: cert-manager
|
|
spec:
|
|
secretName: wildcard-unkin-net-tls
|
|
secretTemplate:
|
|
annotations:
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
|
|
privateKey:
|
|
size: 4096
|
|
dnsNames:
|
|
- "*.unkin.net"
|
|
issuerRef:
|
|
name: letsencrypt
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|