---
# ClusterIssuers — Let's Encrypt via ACME DNS-01 against the keithjackson.dev zone (Cloudflare).
# ADR-0006 mandates BOTH a staging issuer (bring-up) and a prod issuer. DNS-01 enables wildcard
# certs and does NOT require exposing the service (works for internal-only services, R-TLS-03).
#
# Phase 0 STUB: emails/tokens are placeholders. The Cloudflare API token is referenced BY NAME only
# and will be committed SOPS-encrypted (OQ-4, ADR-0007) — NO plaintext secret here.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: REPLACE-ME@keithjackson.dev        # TODO(WS-SEC): ACME account email
    privateKeySecretRef:
      name: letsencrypt-staging-account-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token       # SOPS-encrypted (WS-SEC) — name only
              key: api-token
        selector:
          dnsZones:
            - "keithjackson.dev"
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: REPLACE-ME@keithjackson.dev        # TODO(WS-SEC): ACME account email
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token       # SOPS-encrypted (WS-SEC) — name only
              key: api-token
        selector:
          dnsZones:
            - "keithjackson.dev"
# The active issuer per environment is chosen via ${ACME_CLUSTER_ISSUER} (cluster-vars):
# dev -> letsencrypt-staging, prod -> letsencrypt-prod (R-ENV-02). See gateway/ wildcard Certificate.