fix: let acme own wildcard certificate files #30

2026-08-31T18:59:26Z

autonomic-bot commented

2026-08-31 18:59:26 +00:00

What changed

Removes the retired SOPS declarations that restored /var/lib/ci-certs/live/{fullchain.pem,privkey.pem} at every NixOS activation.

Why

The production ACME certificate was issued successfully, but activation restored the legacy certificate afterward, preventing Traefik from retaining the renewed pair. security.acme is now the sole owner of these runtime files.

Evidence

SHA-256 prefixes showed the runtime certificate reverting to the legacy SOPS chain while the issued production ACME chain remained at /var/lib/acme/ci.commoninternet.net.
NixOS configuration evaluation and targeted Nix formatting checks pass.
The change removes secret delivery rather than adding credentials or placing a secret in Git/Nix.

## What changed Removes the retired SOPS declarations that restored `/var/lib/ci-certs/live/{fullchain.pem,privkey.pem}` at every NixOS activation. ## Why The production ACME certificate was issued successfully, but activation restored the legacy certificate afterward, preventing Traefik from retaining the renewed pair. `security.acme` is now the sole owner of these runtime files. ## Evidence - SHA-256 prefixes showed the runtime certificate reverting to the legacy SOPS chain while the issued production ACME chain remained at `/var/lib/acme/ci.commoninternet.net`. - NixOS configuration evaluation and targeted Nix formatting checks pass. - The change removes secret delivery rather than adding credentials or placing a secret in Git/Nix.

autonomic-bot added 1 commit 2026-08-31 18:59:26 +00:00

fix: let acme own wildcard certificate files 10ecb741e7

autonomic-bot merged commit 7147d777ee into main

2026-08-31 18:59:27 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#30