---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: garrettstone499@gmail.com
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
      - dns01:
          cloudflare:
            email: garrettstone499@gmail.com
            apiTokenSecretRef:
              name: cloudflare-token-secret
              key: cloudflare-token
        selector:
          dnsZones:
            - "kube.huskypup.net"
            # GitLab cross-site replication (see
            # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) -
            # first real Let's Encrypt cert needed for anything under
            # ha.huskypup.net (the floating-hostname zone used for
            # cross-site Postgres/Gitaly addressing) - everything
            # before this used CNPG's own self-signed certs, never hit
            # this gap. Confirmed live: DNS-01 order failed with "no
            # configured challenge solvers can be used for this
            # challenge" until this zone was added. Same Cloudflare
            # account/token as kube.huskypup.net.
            - "ha.huskypup.net"

---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: garrettstone499@gmail.com
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - dns01:
          cloudflare:
            email: garrettstone499@gmail.com
            apiTokenSecretRef:
              name: cloudflare-token-secret
              key: cloudflare-token
        selector:
          dnsZones:
            - "kube.huskypup.net"