recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record acme-dns handoff

Browse Source
This commit was merged in pull request #15.
This commit is contained in:
autonomic-bot
2026-08-31 17:17:09 +00:00
parent 07bc0a15d5 521f6e6934
commit 012212498d
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/JOURNAL.md
+24
View File
@@ -929,3 +929,27 @@ progressing (surveying the 9 remaining recipes). Watching it through to completi
and a fresh small session is running, the gate should see progress and stand down. and a fresh small session is running, the gate should see progress and stand down.
- Lesson: when a weekly run dies mid-flight on a giant context, do NOT resume the original session — - Lesson: when a weekly run dies mid-flight on a giant context, do NOT resume the original session —
start fresh and scope to the remaining recipes. The /upgrade-all skill is idempotent so this is safe. start fresh and scope to the remaining recipes. The /upgrade-all skill is idempotent so this is safe.
## Session 2026-08-31 17:17 UTC — restricted acme-dns renewal staged
**What happened:** Implemented and deployed the cc-ci restricted ACME DNS-01 design in cc-ci PRs
#24–#27 (all merged). The initial `sqlite3` backend setting was detected during staging bootstrap
and corrected to acme-dns 2.x `sqlite` before any account registration succeeded.
**Live state:**
- `acme-dns` is authoritative for `acme.commoninternet.net` on `91.98.47.73`, with public UDP/TCP
53 verified directly; it serves the apex NS and `ns-acme.commoninternet.net A 91.98.47.73`.
- Its HTTP update API is bound solely to `127.0.0.1:8080`; registration is disabled (local POST
returns 403). The one restricted Lego account is stored mode `0600` under `/var/lib/acme/`, outside
Git and the Nix store. No Gandi credentials were used or stored.
- Nix ACME is in Let's Encrypt staging mode for `ci.commoninternet.net` and its wildcard; its renewal
timer is enabled. Traefik handoff remains production-gated so staging cannot replace the live cert.
- Every server deployment used `nixos-rebuild test`, reachability/service verification, then
`nixos-rebuild switch` on `#cc-ci-hetzner`.
**Manual Gandi handoff (only blocker):** Add the parent-zone A+NS delegation and permanent CNAME:
`ns-acme.commoninternet.net. A 91.98.47.73`,
`acme.commoninternet.net. NS ns-acme.commoninternet.net.`, and
`_acme-challenge.ci.commoninternet.net. CNAME
9d3f0428-eb97-4b14-bb07-da2f0f6c2073.acme.commoninternet.net.` Once propagated, resume with a
staging issuance, then production cutover/handoff verification. Do not obtain or add a Gandi token.