Resolve OQ-1/2/3, refine OQ-4: single ExpressVPN gateway, single WAN, external media

Operator answers folded into the specs:
- OQ-3 VPN: ExpressVPN, cluster-controlled SINGLE shared in-cluster tunnel
  (OpenVPN UDP / non-TCP), rules enforced outside the service. New ADR-0012
  supersedes ADR-0008 (Gluetun-sidecar default dropped). Central kill-switch.
- OQ-1 WAN/edge: one commercial WAN, no multi-ISP plans; dumb SOHO edge (no
  VLAN/VPN/services). Multi-WAN out of scope; segmentation + VPN in-cluster;
  edge = NAT + manual port-forward. Gateway VIP resolved to Cilium L2
  announcement. T-3.3 marked won't-do.
- OQ-2 storage: bulk media lives outside the cluster (backing TBD, non-blocking)
  via a 'bulk' external-mount indirection; Plex metadata DB stays on Longhorn.
  Split out a separate OQ-BKP for the off-cluster DR backup target (Phase 4).
- OQ-4 refined: wildcard record covers reachability but NOT ACME DNS-01 (needs
  TXT-write access) and does not match *.home.* depth. Still OPEN: Cloudflare
  API token (Option A) vs acme-dns delegation (Option B). T-2.4/T-2.5 blocked.

Updated: docs 00,01,03,04,08,09; ADR-0008/0012 + index; task board.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/08-tls-and-certificates.md

@@ -28,6 +28,25 @@ services (R-TLS-01/02/03).
   needs no new cert), with per-service certs available where isolation warrants.
 - The DNS provider API token is a SOPS-encrypted secret ([07](07-security-and-secrets.md)).
 
+## DNS-01 challenge access (OQ-4 — the one open item)
+
+Cloudflare already has a wildcard `*.keithjackson.dev` → public-IP record. **That covers
+reachability but not certificate issuance**: ACME DNS-01 requires cert-manager to **write
+`_acme-challenge` TXT records**, and the existing wildcard does not match two-label-deep names like
+`plex.home.keithjackson.dev`. So a **challenge-access decision is still required**:
+
+- **Option A — scoped Cloudflare API token** (Zone·DNS·Edit for `keithjackson.dev`), stored
+  SOPS-encrypted ([07](07-security-and-secrets.md)). cert-manager writes TXT challenges and
+  ExternalDNS manages the `*.home.keithjackson.dev` records — **fully automated**. *Recommended
+  (simplest).*
+- **Option B — acme-dns delegation**: a one-time `_acme-challenge` **CNAME** in Cloudflare points to
+  an in-cluster acme-dns server; cert-manager writes only to acme-dns, so **no standing Cloudflare
+  credential** lives in the cluster. More moving parts; public `*.home` records then need the
+  one-time wildcard record instead of ExternalDNS.
+
+Either option supports the wildcard `*.home.keithjackson.dev` cert and internal-only issuance
+(R-TLS-03). This is the remaining blocker for the TLS/DNS workstream (Phase 2).
+
 ## Renewal & revocation (R-TLS-02)
 
 - cert-manager renews well before expiry automatically; no human action.
@@ -57,5 +76,7 @@ CA distribution. Split-horizon DNS ([09](09-dns-and-ingress.md)) resolves
 - Onboarding a new service requires no manual certificate step.
 
 ## Open questions
-- **OQ-4** — confirm DNS provider (Cloudflare assumed) and an API token scoped for DNS-01.
-- Wildcard vs. per-service certs as the default (pinned in ADR-0006).
+- **OQ-4** — DNS-01 challenge access: **Option A (scoped Cloudflare API token, recommended)** vs
+  **Option B (acme-dns delegation)**. Provider is Cloudflare (confirmed). This is the only item still
+  blocking Phase 2 TLS.
+- Wildcard vs. per-service certs default — **resolved: wildcard** `*.home.keithjackson.dev` (ADR-0006).