From 6f802826dfa555196d7dad9f0aff195f8ff509ca Mon Sep 17 00:00:00 2001 From: Brad Rodgers Date: Fri, 9 Oct 2026 08:05:19 -0400 Subject: [PATCH] k8s: pre-issue the production TLS cert for the internal hop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Public traffic terminates TLS at the Pangolin VPS, which then proxies to the control-plane nodes over https:443 — the pattern every other k3s-backed Pangolin resource follows — so the cluster needs its own valid certificate for the production hostnames, not just the staging one. Add www.bluecapstrategies.com and bluecapstrategies.com to the tls block as bluecap-website-tls. Safe to do before cutover, and deliberately done now: letsencrypt-prod solves DNS-01 through Cloudflare, so issuance only needs a temporary TXT record in the zone. No A record has to point at the cluster and the live WordPress site is untouched. The Cloudflare token was extended to cover the zone on 2026-10-09. Both hostnames are listed because the canonical-host decision is still open; holding a cert for each keeps either choice available, and the redirect is configured separately. Pangolin's edge certificate is HTTP-01 and cannot be pre-issued this way; it is obtained on the first HTTPS request after DNS moves. --- k8s/ingress.yaml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml index 3e5e296..4e0aef8 100644 --- a/k8s/ingress.yaml +++ b/k8s/ingress.yaml @@ -25,10 +25,26 @@ metadata: cert-manager.io/cluster-issuer: letsencrypt-prod spec: tls: - # Staging only, for now. Production hosts join this list at cutover (see header). - hosts: - bcs.int.7tl-homelab.com secretName: bcs-int-tls + # Production hostnames. This is the INTERNAL hop only: public traffic terminates TLS at the + # Pangolin VPS, which then proxies to these nodes over https:443 (the pattern every other + # k3s-backed Pangolin resource uses), so the cluster needs its own valid cert for these names. + # + # Safe to issue before cutover and deliberately done so: letsencrypt-prod solves DNS-01 via + # Cloudflare, which only needs a temporary TXT record in the zone — no A record has to point + # here, and the live WordPress site is unaffected. Pangolin's own edge cert is HTTP-01 and + # CANNOT be pre-issued; it is obtained on the first request after DNS moves. See + # docs/launch-checklist.md section 1.1. + # + # Both names are listed because the canonical-host decision (section 1.6) is still open; + # holding a cert for each keeps either choice available. The redirect is configured + # separately and does not depend on this. + - hosts: + - www.bluecapstrategies.com + - bluecapstrategies.com + secretName: bluecap-website-tls rules: - host: bcs.int.7tl-homelab.com http: