# platform/cert-manager

**cert-manager** — trusted TLS via **Let's Encrypt**, **ACME DNS-01** (Cloudflare).

- **Governing ADR:** [ADR-0006 — TLS: cert-manager + Let's Encrypt (DNS-01)](../../../home-network-k3s/decisions/adr-0006-tls-cert-manager-letsencrypt.md)
- **Spec:** [docs/08 — TLS & Certificates](../../../home-network-k3s/docs/08-tls-and-certificates.md),
  [docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
- **Serves:** R-TLS-01/02/03, R-DNS-01
- **Owner:** WS-SEC

## What this stub is

Flux `HelmRelease` + **two `ClusterIssuer`s** (`letsencrypt-staging`, `letsencrypt-prod` — both
mandated by ADR-0006). DNS-01 against the `keithjackson.dev` zone validates domain control **without
exposing the service** (works for internal-only services, R-TLS-03) and enables the **wildcard**
`*.home.keithjackson.dev` cert defined in [`../gateway`](../gateway).

## Contract (Issuer + Gateway TLS)

Part of the "Issuer + Gateway TLS" interface (`roadmap/workstreams.md`, WS-SEC + WS-NET): the wildcard
`Certificate` (in `gateway/`) references the issuer named by `${ACME_CLUSTER_ISSUER}` and its secret
is consumed by the Gateway HTTPS listener.

## Secrets

The Cloudflare API token is referenced **by name** (`cloudflare-api-token`) and committed
**SOPS-encrypted** (WS-SEC, OQ-4, ADR-0007). **No plaintext token in git.**

## TODO (later phases)

- **OQ-4 (resolved to Cloudflare):** WS-SEC provisions the scoped Cloudflare token, SOPS-encrypted.
- Set the ACME account email.
- **Phase 2 (WS-SEC):** issue the wildcard cert; prove a trusted, non-self-signed cert at
  `*.home.keithjackson.dev` (R-TLS-01/03, Phase-2 exit gate).