feat: promote acme-dns renewal to production

nix/modules/acme-dns.nix

@@ -14,6 +14,7 @@ let
     nsadmin = "hostmaster.commoninternet.net"
     records = [
       "acme.commoninternet.net. NS ns-acme.commoninternet.net.",
+      "ns-acme.commoninternet.net. A 91.98.47.73",
     ]
     debug = false
 
@@ -27,9 +28,9 @@ let
     ip = "127.0.0.1"
     port = "8080"
     tls = "none"
-    # Bootstrap registration is deliberately temporary. Once the single Lego
-    # account exists, change this to true in a follow-up reviewed deployment.
-    disable_registration = false
+    # The one Lego account was bootstrapped before this configuration was
+    # hardened. Updates authenticated by that account remain available.
+    disable_registration = true
     corsorigins = []
 
     [logconfig]
@@ -56,6 +57,12 @@ in
 
   environment.etc."acme-dns/lego.env".source = legoEnvironment;
 
+  # The staging order has completed successfully. This marker permits the
+  # production ACME post-run hook to hand a renewed certificate to Traefik.
+  systemd.tmpfiles.rules = [
+    "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
+  ];
+
   networking.firewall = {
     allowedTCPPorts = [ 53 ];
     allowedUDPPorts = [ 53 ];
@@ -130,15 +137,15 @@ in
     certs."ci.commoninternet.net" = {
       domain = "ci.commoninternet.net";
       extraDomainNames = [ "*.ci.commoninternet.net" ];
-      # The pinned Lego provider spells this `acmedns`; keep the service on
-      # staging until the operator has installed the permanent CNAME.
+      # Staging issuance succeeded using the permanent, narrowly delegated
+      # CNAME. Production uses the same restricted acme-dns account.
       dnsProvider = "acmedns";
       environmentFile = "/etc/acme-dns/lego.env";
       dnsResolver = "1.1.1.1:53";
-      server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      server = "https://acme-v02.api.letsencrypt.org/directory";
       postRun = ''
-        # Production cutover creates this marker in a separate reviewed
-        # deployment. Staging issuance must never replace the live cert.
+        # The production marker is deployed only after staging proves the
+        # permanent CNAME and restricted acme-dns account work end to end.
         if [ -e /var/lib/ci-certs/acme-production-enabled ]; then
           ${pkgs.systemd}/bin/systemctl --no-block start cc-ci-acme-traefik-handoff.service
         fi