feat: prepare restricted acme-dns renewal #24

2026-08-31T17:09:02Z

autonomic-bot commented

2026-08-31 17:09:02 +00:00

What changed

Adds a local acme-dns authority for the narrowly delegated acme.commoninternet.net zone and prepares NixOS security.acme to obtain ci.commoninternet.net + *.ci.commoninternet.net through its localhost-only API. The ACME service begins in Let’s Encrypt staging and persists only its restricted acme-dns account outside Git/Nix.

Traefik’s immutable Swarm secrets are now versioned from the public certificate-chain digest, and a production-only handoff service atomically installs a renewed certificate, runs the existing health-gated Traefik reconciliation, then best-effort removes obsolete secret versions.

Why

The expired wildcard certificate cannot be renewed safely with a broad Gandi credential. This design leaves Gandi authoritative for the parent zone; the server will control only the delegated subzone and one permanent ACME challenge CNAME.

Evidence

nix eval --impure --raw path:/mnt/data/srv/cc-ci-orch/cc-ci#nixosConfigurations.cc-ci-hetzner.config.system.build.toplevel.drvPath completed successfully.
pytest -q tests/unit/test_acme_dns.py completed: 2 passed.
Targeted Ruff format/check completed for runner/warm_reconcile.py and the new unit test.
nixpkgs-fmt, statix, and deadnix passed. The full repo lint remains red solely on pre-existing formatting in 90 unrelated files plus one unrelated Ruff finding; this PR adds none.

## What changed Adds a local acme-dns authority for the narrowly delegated `acme.commoninternet.net` zone and prepares NixOS `security.acme` to obtain `ci.commoninternet.net` + `*.ci.commoninternet.net` through its localhost-only API. The ACME service begins in Let’s Encrypt staging and persists only its restricted acme-dns account outside Git/Nix. Traefik’s immutable Swarm secrets are now versioned from the public certificate-chain digest, and a production-only handoff service atomically installs a renewed certificate, runs the existing health-gated Traefik reconciliation, then best-effort removes obsolete secret versions. ## Why The expired wildcard certificate cannot be renewed safely with a broad Gandi credential. This design leaves Gandi authoritative for the parent zone; the server will control only the delegated subzone and one permanent ACME challenge CNAME. ## Evidence - `nix eval --impure --raw path:/mnt/data/srv/cc-ci-orch/cc-ci#nixosConfigurations.cc-ci-hetzner.config.system.build.toplevel.drvPath` completed successfully. - `pytest -q tests/unit/test_acme_dns.py` completed: 2 passed. - Targeted Ruff format/check completed for `runner/warm_reconcile.py` and the new unit test. - `nixpkgs-fmt`, statix, and deadnix passed. The full repo lint remains red solely on pre-existing formatting in 90 unrelated files plus one unrelated Ruff finding; this PR adds none.

autonomic-bot added 1 commit 2026-08-31 17:09:03 +00:00

feat: prepare restricted acme-dns renewal 148d4c9381

autonomic-bot merged commit 0db8194dd5 into main

2026-08-31 17:09:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#24