recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

domain cutover: ci.autonomic.zone — cert, front doors, drone, harness naming #39

Merged
autonomic-bot merged 1 commits from domain-cutover into main 2026-09-21 16:53:35 +00:00
Conversation 0 Commits 1 Files Changed 16
+102 -34
autonomic-bot commented 2026-09-21 16:53:34 +00:00
Owner
Copy Link
Copy Source

Implements the cc-ci side of the domain migration (plan: cc-ci-orchestrator cc-ci-plan/plan-domain-migration-ci-autonomic-zone.md). DNS records are already live in the autonomic.zone Gandi zone (verified: apex+wildcard A 195.201.88.249, _acme-challenge CNAME → the existing acme-dns account).

Key simplification vs the plan: instead of dual-cert SNI in the traefik reconciler, ONE Let's Encrypt cert carries SANs for BOTH zones (ci + *.ci of autonomic.zone AND commoninternet.net) — the unchanged single-pair ssl_cert/ssl_key reconciler keeps working, and the legacy zone serves off the same cert until Phase 4 drops its SANs. The new zone's DNS-01 challenge goes through the SAME acme-dns account (storage re-keyed by a seed oneshot; disable_registration stays true; the CNAME already delegates to it).

Dual Host rules everywhere during the bake window; old names keep working until the operator's Phase 4 record cleanup. Warm stacks + backupbot deliberately stay on the legacy zone (data-warm volumes / restic password tied to the abra app name) — post-bake migration.

Verification so far: python/nix/shell syntax clean; deployment + cert issuance + e2e verified on the host after merge (see the orchestrator-side PR + deploy log).

Implements the cc-ci side of the domain migration (plan: cc-ci-orchestrator cc-ci-plan/plan-domain-migration-ci-autonomic-zone.md). DNS records are already live in the autonomic.zone Gandi zone (verified: apex+wildcard A 195.201.88.249, _acme-challenge CNAME → the existing acme-dns account). Key simplification vs the plan: instead of dual-cert SNI in the traefik reconciler, ONE Let's Encrypt cert carries SANs for BOTH zones (ci + *.ci of autonomic.zone AND commoninternet.net) — the unchanged single-pair ssl_cert/ssl_key reconciler keeps working, and the legacy zone serves off the same cert until Phase 4 drops its SANs. The new zone's DNS-01 challenge goes through the SAME acme-dns account (storage re-keyed by a seed oneshot; disable_registration stays true; the CNAME already delegates to it). Dual Host rules everywhere during the bake window; old names keep working until the operator's Phase 4 record cleanup. Warm stacks + backupbot deliberately stay on the legacy zone (data-warm volumes / restic password tied to the abra app name) — post-bake migration. Verification so far: python/nix/shell syntax clean; deployment + cert issuance + e2e verified on the host after merge (see the orchestrator-side PR + deploy log).
autonomic-bot added 1 commit 2026-09-21 16:53:34 +00:00
domain cutover: front doors + drone + per-run naming to ci.autonomic.zone
continuous-integration/drone/push Build is failing
Details
542e8cfb11 
- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.
autonomic-bot merged commit 93b86e0cc1 into main 2026-09-21 16:53:35 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#39