rock
e93d4ba86c
The ACME DNS-01 self-check resolved through CoreDNS and never saw the TXT record. The wildcard renewal stalled on 2026-09-23 and riotpiao-com-tls expired on 2026-10-23. Every Cloudflare Tunnel origin then failed with "x509: certificate has expired or is not yet valid". Changes: - cert-manager: pin the self-check to the public resolvers with --dns01-recursive-nameservers and --dns01-recursive-nameservers-only. Verified against Let's Encrypt staging: the challenge went valid and the certificate issued. - comfyui and forgejo: drop the per-host tls blocks and the cert-manager.io/cluster-issuer annotations. The wildcard covers both hosts, and the per-host certificates (comfyui-tls, forgejo-tls) expired with the wildcard. - riotpiao-com-cert: document the wildcard as nginx's default certificate and the zero-downtime renewal path. Renewal now runs 30 days before expiry, writes the same secret, and nginx hot-reloads without a pod restart.
34 lines
1.4 KiB
YAML
34 lines
1.4 KiB
YAML
# k8s/bootstrap/ingress/riotpiao-com-cert.yaml
|
|
# Public wildcard cert for *.riotpiao.com, signed by Let's Encrypt (DNS-01 via
|
|
# Cloudflare, see ../cert-manager/letsencrypt-issuer.yaml).
|
|
#
|
|
# nginx serves this secret as its default-ssl-certificate
|
|
# (../ingress/nginx-values.yaml), so every Ingress that omits a tls: block uses
|
|
# it. Do not add per-host tls: blocks for *.riotpiao.com hosts: they create a
|
|
# second, single-host certificate and split the wildcard coverage.
|
|
#
|
|
# Renewal is automatic and does not drop traffic:
|
|
# - cert-manager starts a new order 30 days before expiry (renewBefore).
|
|
# - cert-manager writes the renewed pair into the same secret.
|
|
# - ingress-nginx watches the secret and hot-reloads. No pod restart.
|
|
# - The old pair stays valid until the new one is written, so no gap exists.
|
|
#
|
|
# The DNS-01 self-check must reach the public resolvers directly. Without the
|
|
# --dns01-recursive-nameservers flags in ../../cert-manager/cert-manager-values.yaml
|
|
# the self-check never sees the TXT record and renewal stalls until expiry.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: riotpiao-com-tls
|
|
namespace: ingress-nginx
|
|
spec:
|
|
secretName: riotpiao-com-tls
|
|
dnsNames:
|
|
- "*.riotpiao.com"
|
|
- "riotpiao.com"
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
duration: 2160h # 90 days (LE max)
|
|
renewBefore: 720h # renew 30 days before expiry
|