From 1febd18bd6a0b9b643caf9b2266bdf5f7fe8c9dc Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Sat, 22 Aug 2026 14:25:36 -0500 Subject: [PATCH] Widen letsencrypt-production DNS-01 solver to cover ha.huskypup.net GitLab's new Gitaly/workhorse TLS certs are the first thing needing a real Let's Encrypt cert under ha.huskypup.net (the cross-site floating- hostname zone) - everything else there (Postgres) uses CNPG's own self-signed certs, never hit this gap. Confirmed live: DNS-01 order failed with 'no configured challenge solvers can be used for this challenge' until this zone was added to the selector. Co-Authored-By: Claude Sonnet 5 --- .../manifests/letsencrypt-issuer.yaml | 35 ++++++++++++------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/infrastructure/cert-manager/manifests/letsencrypt-issuer.yaml b/infrastructure/cert-manager/manifests/letsencrypt-issuer.yaml index b67ff41..619a4ac 100644 --- a/infrastructure/cert-manager/manifests/letsencrypt-issuer.yaml +++ b/infrastructure/cert-manager/manifests/letsencrypt-issuer.yaml @@ -1,15 +1,15 @@ ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-production -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: garrettstone499@gmail.com - privateKeySecretRef: - name: letsencrypt-production - solvers: +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: garrettstone499@gmail.com + privateKeySecretRef: + name: letsencrypt-production + solvers: - dns01: cloudflare: email: garrettstone499@gmail.com @@ -19,6 +19,17 @@ spec: selector: dnsZones: - "kube.huskypup.net" + # GitLab cross-site replication (see + # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - + # first real Let's Encrypt cert needed for anything under + # ha.huskypup.net (the floating-hostname zone used for + # cross-site Postgres/Gitaly addressing) - everything + # before this used CNPG's own self-signed certs, never hit + # this gap. Confirmed live: DNS-01 order failed with "no + # configured challenge solvers can be used for this + # challenge" until this zone was added. Same Cloudflare + # account/token as kube.huskypup.net. + - "ha.huskypup.net" --- apiVersion: cert-manager.io/v1