jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
49 lines
1.8 KiB
YAML
49 lines
1.8 KiB
YAML
---
|
|
# ClusterIssuers — Let's Encrypt via ACME DNS-01 against the keithjackson.dev zone (Cloudflare).
|
|
# ADR-0006 mandates BOTH a staging issuer (bring-up) and a prod issuer. DNS-01 enables wildcard
|
|
# certs and does NOT require exposing the service (works for internal-only services, R-TLS-03).
|
|
#
|
|
# Phase 0 STUB: emails/tokens are placeholders. The Cloudflare API token is referenced BY NAME only
|
|
# and will be committed SOPS-encrypted (OQ-4, ADR-0007) — NO plaintext secret here.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-staging
|
|
spec:
|
|
acme:
|
|
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
email: [email protected] # TODO(WS-SEC): ACME account email
|
|
privateKeySecretRef:
|
|
name: letsencrypt-staging-account-key
|
|
solvers:
|
|
- dns01:
|
|
cloudflare:
|
|
apiTokenSecretRef:
|
|
name: cloudflare-api-token # SOPS-encrypted (WS-SEC) — name only
|
|
key: api-token
|
|
selector:
|
|
dnsZones:
|
|
- "keithjackson.dev"
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
email: [email protected] # TODO(WS-SEC): ACME account email
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod-account-key
|
|
solvers:
|
|
- dns01:
|
|
cloudflare:
|
|
apiTokenSecretRef:
|
|
name: cloudflare-api-token # SOPS-encrypted (WS-SEC) — name only
|
|
key: api-token
|
|
selector:
|
|
dnsZones:
|
|
- "keithjackson.dev"
|
|
# The active issuer per environment is chosen via ${ACME_CLUSTER_ISSUER} (cluster-vars):
|
|
# dev -> letsencrypt-staging, prod -> letsencrypt-prod (R-ENV-02). See gateway/ wildcard Certificate.
|