Story Crater Bot
21e3987b11
Wildcard cert was left on letsencrypt-staging; staging root is not browser-trusted so HTTPS to *.riotpiao.com fails cert validation. Switch issuerRef to letsencrypt-prod to issue a trusted wildcard.
26 lines
1000 B
YAML
26 lines
1000 B
YAML
# k8s/bootstrap/ingress/riotpiao-com-cert.yaml
|
|
# Public wildcard cert for *.riotpiao.com, signed by Let's Encrypt (DNS-01 via
|
|
# Cloudflare, see ../cert-manager/letsencrypt-issuer.yaml). Distinct from
|
|
# homelab-tls (self-signed homelab-ca, internal *.riotpiao.com) —
|
|
# reference riotpiao-com-tls explicitly on ingresses that expose riotpiao.com
|
|
# hosts to the internet; it is not nginx's default-ssl-certificate.
|
|
#
|
|
# issuerRef starts on letsencrypt-staging. Switch to letsencrypt-prod once the
|
|
# staging cert issues cleanly, then delete this Certificate's Secret to force
|
|
# a re-issue against prod (staging certs aren't browser-trusted).
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: riotpiao-com-tls
|
|
namespace: ingress-nginx
|
|
spec:
|
|
secretName: riotpiao-com-tls
|
|
dnsNames:
|
|
- "*.riotpiao.com"
|
|
- "riotpiao.com"
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
duration: 2160h # 90 days (LE max)
|
|
renewBefore: 720h # renew 30 days before expiry
|