recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

plan: add restricted acme-dns renewal design #23

Merged
autonomic-bot merged 1 commits from plan/acme-dns-renewal into main 2026-08-31 17:00:39 +00:00
Conversation 0 Commits 1 Files Changed 1
+283
autonomic-bot commented 2026-08-31 17:00:28 +00:00
Owner
Copy Link
Copy Source

What changed

Adds a cc-ci-specific plan for restricted wildcard renewal using local acme-dns and NixOS ACME/Lego. It maps the real Hetzner host, direct DNS authority, the two manual Gandi changes, and the required Traefik Swarm-secret rotation.

Why

The current wildcard is expired. The old generic plan did not account for the gateway TLS-passthrough topology, NixOS deployment discipline, existing sops certificate files, or Traefik receiving certificates as immutable Swarm secrets.

Evidence

  • Live host inspected: NixOS 26.05, public IPv4 91.98.47.73, no current port-53 listener or ACME service, firewall lacks 53.
  • Live Traefik certificate inspected: expired 2026-08-24 18:18:52 UTC.
  • Pinned nixpkgs provides acme-dns and Lego; NixOS ACME supports DNS providers, environment files, and post-renew hooks.
  • Secret audit passed: 58 values scanned, 0 findings.
## What changed Adds a cc-ci-specific plan for restricted wildcard renewal using local acme-dns and NixOS ACME/Lego. It maps the real Hetzner host, direct DNS authority, the two manual Gandi changes, and the required Traefik Swarm-secret rotation. ## Why The current wildcard is expired. The old generic plan did not account for the gateway TLS-passthrough topology, NixOS deployment discipline, existing sops certificate files, or Traefik receiving certificates as immutable Swarm secrets. ## Evidence - Live host inspected: NixOS 26.05, public IPv4 91.98.47.73, no current port-53 listener or ACME service, firewall lacks 53. - Live Traefik certificate inspected: expired 2026-08-24 18:18:52 UTC. - Pinned nixpkgs provides acme-dns and Lego; NixOS ACME supports DNS providers, environment files, and post-renew hooks. - Secret audit passed: 58 values scanned, 0 findings.
autonomic-bot added 1 commit 2026-08-31 17:00:28 +00:00
plan: add restricted acme-dns renewal design c24bd0c62c
autonomic-bot merged commit cb315f8ab4 into main 2026-08-31 17:00:39 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#23