homelab/k8s/bootstrap/cert-manager/cert-manager-values.yaml

# k8s/cert-manager/cert-manager-values.yaml
# cert-manager issues every per-hostname cert off homelab-ca and renews the
# wildcard cert nginx serves — certmanager_certificate_expiration_timestamp_seconds
# is the early-warning signal before any service's TLS breaks.

# CRDs must be installed by the chart — ArgoCD helm-template does not apply a
# chart's crds/ folder, and the ClusterIssuer/Certificate resources (wave 1)
# depend on them existing first.
installCRDs: true

# Point the ACME DNS-01 self-check at the public resolvers directly.
#
# Without these flags cert-manager resolves through the pod resolver
# (CoreDNS at 10.96.0.10). The self-check then never saw the TXT record and
# reported "Waiting for DNS-01 challenge propagation" forever. The wildcard
# certificate renewal stalled on 2026-09-23 and the cert expired on
# 2026-10-23, which broke every Cloudflare Tunnel origin with
# "x509: certificate has expired".
#
extraArgs:
  - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53
  - --dns01-recursive-nameservers-only

# Tolerate the control-plane taint (talos-cp-1 is the only schedulable node).
tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
webhook:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule
cainjector:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule
startupapicheck:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

prometheus:
  enabled: true
  servicemonitor:
    enabled: true
    interval: 60s