docs: record acme-dns production issuance

cc-ci-plan/JOURNAL.md

@@ -929,3 +929,50 @@ progressing (surveying the 9 remaining recipes). Watching it through to completi
   and a fresh small session is running, the gate should see progress and stand down.
 - Lesson: when a weekly run dies mid-flight on a giant context, do NOT resume the original session —
   start fresh and scope to the remaining recipes. The /upgrade-all skill is idempotent so this is safe.
+
+## Session 2026-08-31 17:17 UTC — restricted acme-dns renewal staged
+
+**What happened:** Implemented and deployed the cc-ci restricted ACME DNS-01 design in cc-ci PRs
+#24–#27 (all merged). The initial `sqlite3` backend setting was detected during staging bootstrap
+and corrected to acme-dns 2.x `sqlite` before any account registration succeeded.
+
+**Live state:**
+- `acme-dns` is authoritative for `acme.commoninternet.net` on `91.98.47.73`, with public UDP/TCP
+  53 verified directly; it serves the apex NS and `ns-acme.commoninternet.net A 91.98.47.73`.
+- Its HTTP update API is bound solely to `127.0.0.1:8080`; registration is disabled (local POST
+  returns 403). The one restricted Lego account is stored mode `0600` under `/var/lib/acme/`, outside
+  Git and the Nix store. No Gandi credentials were used or stored.
+- Nix ACME is in Let's Encrypt staging mode for `ci.commoninternet.net` and its wildcard; its renewal
+  timer is enabled. Traefik handoff remains production-gated so staging cannot replace the live cert.
+- Every server deployment used `nixos-rebuild test`, reachability/service verification, then
+  `nixos-rebuild switch` on `#cc-ci-hetzner`.
+
+**Manual Gandi handoff (only blocker):** Add the parent-zone A+NS delegation and permanent CNAME:
+`ns-acme.commoninternet.net. A 91.98.47.73`,
+`acme.commoninternet.net. NS ns-acme.commoninternet.net.`, and
+`_acme-challenge.ci.commoninternet.net. CNAME
+9d3f0428-eb97-4b14-bb07-da2f0f6c2073.acme.commoninternet.net.` Once propagated, resume with a
+staging issuance, then production cutover/handoff verification. Do not obtain or add a Gandi token.
+
+## Session 2026-08-31 19:05 UTC — ACME production issuance complete
+
+**Completed:** The operator added the narrow Gandi delegation and permanent CNAME. Staging then
+validated both `ci.commoninternet.net` and `*.ci.commoninternet.net`; production issuance validated
+the same SAN pair and produced a Let's Encrypt certificate valid through 2026-11-29. cc-ci PRs #28–#30
+were merged to promote production, make Traefik roll certificate-secret changes even when recipe
+upgrades are held, and remove the retired SOPS wildcard-file injection.
+
+**Live cc-ci state:**
+- `/var/lib/acme/ci.commoninternet.net` is the sole source of the production cert/key; the runtime
+  pair matches it, is root-only for the key, and Traefik now references matching versioned Swarm
+  secrets. Reboot-safe `nixos-rebuild switch` completed at cc-ci `7147d77` after the required test
+  activations and health checks.
+- acme-dns remains authoritative only for the delegated subzone, its update API is localhost-only,
+  registration is disabled, and the restricted-account JSON is mode `0600`. The Nix ACME renewal
+  timer is active. No Gandi credential was added.
+
+**External blocker, not cc-ci-owned:** Direct TLS to `91.98.47.73:443` now presents the new valid
+certificate. The operator-managed public gateway at `143.244.213.108` currently accepts TCP then
+closes TLS before presenting a certificate, so its passthrough to cc-ci needs repair/verification.
+The cc-ci plan explicitly marks the gateway as operator infrastructure; do not change the DNS
+delegation or add a Gandi token to work around it.