jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
35 lines
1.6 KiB
Markdown
35 lines
1.6 KiB
Markdown
# platform/cert-manager
|
|
|
|
**cert-manager** — trusted TLS via **Let's Encrypt**, **ACME DNS-01** (Cloudflare).
|
|
|
|
- **Governing ADR:** [ADR-0006 — TLS: cert-manager + Let's Encrypt (DNS-01)](../../../home-network-k3s/decisions/adr-0006-tls-cert-manager-letsencrypt.md)
|
|
- **Spec:** [docs/08 — TLS & Certificates](../../../home-network-k3s/docs/08-tls-and-certificates.md),
|
|
[docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
|
|
- **Serves:** R-TLS-01/02/03, R-DNS-01
|
|
- **Owner:** WS-SEC
|
|
|
|
## What this stub is
|
|
|
|
Flux `HelmRelease` + **two `ClusterIssuer`s** (`letsencrypt-staging`, `letsencrypt-prod` — both
|
|
mandated by ADR-0006). DNS-01 against the `keithjackson.dev` zone validates domain control **without
|
|
exposing the service** (works for internal-only services, R-TLS-03) and enables the **wildcard**
|
|
`*.home.keithjackson.dev` cert defined in [`../gateway`](../gateway).
|
|
|
|
## Contract (Issuer + Gateway TLS)
|
|
|
|
Part of the "Issuer + Gateway TLS" interface (`roadmap/workstreams.md`, WS-SEC + WS-NET): the wildcard
|
|
`Certificate` (in `gateway/`) references the issuer named by `${ACME_CLUSTER_ISSUER}` and its secret
|
|
is consumed by the Gateway HTTPS listener.
|
|
|
|
## Secrets
|
|
|
|
The Cloudflare API token is referenced **by name** (`cloudflare-api-token`) and committed
|
|
**SOPS-encrypted** (WS-SEC, OQ-4, ADR-0007). **No plaintext token in git.**
|
|
|
|
## TODO (later phases)
|
|
|
|
- **OQ-4 (resolved to Cloudflare):** WS-SEC provisions the scoped Cloudflare token, SOPS-encrypted.
|
|
- Set the ACME account email.
|
|
- **Phase 2 (WS-SEC):** issue the wildcard cert; prove a trusted, non-self-signed cert at
|
|
`*.home.keithjackson.dev` (R-TLS-01/03, Phase-2 exit gate).
|