rock
e93d4ba86c
The ACME DNS-01 self-check resolved through CoreDNS and never saw the TXT record. The wildcard renewal stalled on 2026-09-23 and riotpiao-com-tls expired on 2026-10-23. Every Cloudflare Tunnel origin then failed with "x509: certificate has expired or is not yet valid". Changes: - cert-manager: pin the self-check to the public resolvers with --dns01-recursive-nameservers and --dns01-recursive-nameservers-only. Verified against Let's Encrypt staging: the challenge went valid and the certificate issued. - comfyui and forgejo: drop the per-host tls blocks and the cert-manager.io/cluster-issuer annotations. The wildcard covers both hosts, and the per-host certificates (comfyui-tls, forgejo-tls) expired with the wildcard. - riotpiao-com-cert: document the wildcard as nginx's default certificate and the zero-downtime renewal path. Renewal now runs 30 days before expiry, writes the same secret, and nginx hot-reloads without a pod restart.
50 lines
1.6 KiB
YAML
50 lines
1.6 KiB
YAML
# k8s/cert-manager/cert-manager-values.yaml
|
|
# cert-manager issues every per-hostname cert off homelab-ca and renews the
|
|
# wildcard cert nginx serves — certmanager_certificate_expiration_timestamp_seconds
|
|
# is the early-warning signal before any service's TLS breaks.
|
|
|
|
# CRDs must be installed by the chart — ArgoCD helm-template does not apply a
|
|
# chart's crds/ folder, and the ClusterIssuer/Certificate resources (wave 1)
|
|
# depend on them existing first.
|
|
installCRDs: true
|
|
|
|
# Point the ACME DNS-01 self-check at the public resolvers directly.
|
|
#
|
|
# Without these flags cert-manager resolves through the pod resolver
|
|
# (CoreDNS at 10.96.0.10). The self-check then never saw the TXT record and
|
|
# reported "Waiting for DNS-01 challenge propagation" forever. The wildcard
|
|
# certificate renewal stalled on 2026-09-23 and the cert expired on
|
|
# 2026-10-23, which broke every Cloudflare Tunnel origin with
|
|
# "x509: certificate has expired".
|
|
#
|
|
extraArgs:
|
|
- --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53
|
|
- --dns01-recursive-nameservers-only
|
|
|
|
# Tolerate the control-plane taint (talos-cp-1 is the only schedulable node).
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
webhook:
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
cainjector:
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
startupapicheck:
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
prometheus:
|
|
enabled: true
|
|
servicemonitor:
|
|
enabled: true
|
|
interval: 60s
|