fbb7b429e3
cert-manager ClusterIssuers (LE staging+prod) + Certificate writing gitlab-tls-cert, auto-renewing. Scaleway webhook helm-installed (scaleway/scaleway-certmanager-webhook, cert-manager ns); DNS creds in cert-manager/scaleway-dns-credentials. Proxy tls-certs volume repointed live to gitlab-tls-cert. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.5 KiB
YAML
73 lines
2.5 KiB
YAML
# ACME (Let's Encrypt) wildcard cert for *.fxhnt.ai via cert-manager + Scaleway DNS-01.
|
|
# Replaces the prior MANUAL, unrenewed LE cert that expired 2026-05-26 (the tailscale-proxy
|
|
# fell back to the GitLab self-signed cert). DNS-01 is required: the services are tailnet-only
|
|
# (*.fxhnt.ai -> 100.x Tailscale CGNAT) so HTTP-01 is unreachable, and wildcards need DNS-01.
|
|
#
|
|
# Solver creds: cert-manager/scaleway-dns-credentials (SCW_ACCESS_KEY/SCW_SECRET_KEY, copied from
|
|
# foxhunt/scaleway-credentials). Webhook: scaleway-certmanager-webhook (helm, cert-manager ns).
|
|
# The issued secret gitlab-tls-cert is mounted by infra/k8s/gitlab/tailscale-proxy.yaml.
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-staging
|
|
spec:
|
|
acme:
|
|
email: jeroen@grusewski.nl
|
|
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
privateKeySecretRef:
|
|
name: letsencrypt-staging-account-key
|
|
solvers:
|
|
- dns01:
|
|
webhook:
|
|
groupName: acme.scaleway.com
|
|
solverName: scaleway
|
|
config:
|
|
accessKeySecretRef:
|
|
name: scaleway-dns-credentials
|
|
key: SCW_ACCESS_KEY
|
|
secretKeySecretRef:
|
|
name: scaleway-dns-credentials
|
|
key: SCW_SECRET_KEY
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
email: jeroen@grusewski.nl
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod-account-key
|
|
solvers:
|
|
- dns01:
|
|
webhook:
|
|
groupName: acme.scaleway.com
|
|
solverName: scaleway
|
|
config:
|
|
accessKeySecretRef:
|
|
name: scaleway-dns-credentials
|
|
key: SCW_ACCESS_KEY
|
|
secretKeySecretRef:
|
|
name: scaleway-dns-credentials
|
|
key: SCW_SECRET_KEY
|
|
---
|
|
# Wildcard cert for the tailscale-proxy. issuerRef flips staging->prod after staging validates;
|
|
# secretName flips to gitlab-tls-cert (the secret the proxy mounts) for the prod issuance.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: fxhnt-wildcard
|
|
namespace: foxhunt
|
|
spec:
|
|
secretName: gitlab-tls-cert # takes over the secret the tailscale-proxy mounts
|
|
privateKey:
|
|
rotationPolicy: Always # old manual key had a mismatching algorithm; regenerate on issue/renew
|
|
dnsNames:
|
|
- fxhnt.ai
|
|
- "*.fxhnt.ai"
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|