From 521f6e6934fed4ea155a1832de853e554c6ba151 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 31 Aug 2026 17:16:51 +0000 Subject: [PATCH] docs: record acme-dns handoff --- cc-ci-plan/JOURNAL.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/cc-ci-plan/JOURNAL.md b/cc-ci-plan/JOURNAL.md index 4a8d7a1..ba9f037 100644 --- a/cc-ci-plan/JOURNAL.md +++ b/cc-ci-plan/JOURNAL.md @@ -929,3 +929,27 @@ progressing (surveying the 9 remaining recipes). Watching it through to completi and a fresh small session is running, the gate should see progress and stand down. - Lesson: when a weekly run dies mid-flight on a giant context, do NOT resume the original session — start fresh and scope to the remaining recipes. The /upgrade-all skill is idempotent so this is safe. + +## Session 2026-08-31 17:17 UTC — restricted acme-dns renewal staged + +**What happened:** Implemented and deployed the cc-ci restricted ACME DNS-01 design in cc-ci PRs +#24–#27 (all merged). The initial `sqlite3` backend setting was detected during staging bootstrap +and corrected to acme-dns 2.x `sqlite` before any account registration succeeded. + +**Live state:** +- `acme-dns` is authoritative for `acme.commoninternet.net` on `91.98.47.73`, with public UDP/TCP + 53 verified directly; it serves the apex NS and `ns-acme.commoninternet.net A 91.98.47.73`. +- Its HTTP update API is bound solely to `127.0.0.1:8080`; registration is disabled (local POST + returns 403). The one restricted Lego account is stored mode `0600` under `/var/lib/acme/`, outside + Git and the Nix store. No Gandi credentials were used or stored. +- Nix ACME is in Let's Encrypt staging mode for `ci.commoninternet.net` and its wildcard; its renewal + timer is enabled. Traefik handoff remains production-gated so staging cannot replace the live cert. +- Every server deployment used `nixos-rebuild test`, reachability/service verification, then + `nixos-rebuild switch` on `#cc-ci-hetzner`. + +**Manual Gandi handoff (only blocker):** Add the parent-zone A+NS delegation and permanent CNAME: +`ns-acme.commoninternet.net. A 91.98.47.73`, +`acme.commoninternet.net. NS ns-acme.commoninternet.net.`, and +`_acme-challenge.ci.commoninternet.net. CNAME +9d3f0428-eb97-4b14-bb07-da2f0f6c2073.acme.commoninternet.net.` Once propagated, resume with a +staging issuance, then production cutover/handoff verification. Do not obtain or add a Gandi token. -- 2.54.0