From fbb7b429e3793d651a60b079aa35b377cd61b1ad Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Sun, 21 Jun 2026 11:21:30 +0200
Subject: [PATCH] infra(cert): ACME wildcard *.fxhnt.ai via cert-manager +
 Scaleway DNS-01 (replaces expired manual LE cert)

cert-manager ClusterIssuers (LE staging+prod) + Certificate writing gitlab-tls-cert, auto-renewing.
Scaleway webhook helm-installed (scaleway/scaleway-certmanager-webhook, cert-manager ns); DNS creds
in cert-manager/scaleway-dns-credentials. Proxy tls-certs volume repointed live to gitlab-tls-cert.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 infra/k8s/cert-manager/fxhnt-acme.yaml | 72 ++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 infra/k8s/cert-manager/fxhnt-acme.yaml

diff --git a/infra/k8s/cert-manager/fxhnt-acme.yaml b/infra/k8s/cert-manager/fxhnt-acme.yaml
new file mode 100644
index 000000000..63c2b3615
--- /dev/null
+++ b/infra/k8s/cert-manager/fxhnt-acme.yaml
@@ -0,0 +1,72 @@
+# ACME (Let's Encrypt) wildcard cert for *.fxhnt.ai via cert-manager + Scaleway DNS-01.
+# Replaces the prior MANUAL, unrenewed LE cert that expired 2026-05-26 (the tailscale-proxy
+# fell back to the GitLab self-signed cert). DNS-01 is required: the services are tailnet-only
+# (*.fxhnt.ai -> 100.x Tailscale CGNAT) so HTTP-01 is unreachable, and wildcards need DNS-01.
+#
+# Solver creds: cert-manager/scaleway-dns-credentials (SCW_ACCESS_KEY/SCW_SECRET_KEY, copied from
+# foxhunt/scaleway-credentials). Webhook: scaleway-certmanager-webhook (helm, cert-manager ns).
+# The issued secret gitlab-tls-cert is mounted by infra/k8s/gitlab/tailscale-proxy.yaml.
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    email: jeroen@grusewski.nl
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.scaleway.com
+            solverName: scaleway
+            config:
+              accessKeySecretRef:
+                name: scaleway-dns-credentials
+                key: SCW_ACCESS_KEY
+              secretKeySecretRef:
+                name: scaleway-dns-credentials
+                key: SCW_SECRET_KEY
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: jeroen@grusewski.nl
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.scaleway.com
+            solverName: scaleway
+            config:
+              accessKeySecretRef:
+                name: scaleway-dns-credentials
+                key: SCW_ACCESS_KEY
+              secretKeySecretRef:
+                name: scaleway-dns-credentials
+                key: SCW_SECRET_KEY
+---
+# Wildcard cert for the tailscale-proxy. issuerRef flips staging->prod after staging validates;
+# secretName flips to gitlab-tls-cert (the secret the proxy mounts) for the prod issuance.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fxhnt-wildcard
+  namespace: foxhunt
+spec:
+  secretName: gitlab-tls-cert          # takes over the secret the tailscale-proxy mounts
+  privateKey:
+    rotationPolicy: Always             # old manual key had a mismatching algorithm; regenerate on issue/renew
+  dnsNames:
+    - fxhnt.ai
+    - "*.fxhnt.ai"
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer