/goal /ultracode-workflows [DOM-1a] public ACME TLS for the platform domain (letsencrypt-dns01 ClusterIssuer + public wildcard cert) #24
Labels
No labels
bug
discussion
duplicate
enhancement
goal
help wanted
horizon:backlog
horizon:governance
horizon:mvp
invalid
operator-decision
question
roadmap
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
#27 /goal /ultracode-workflows [SPINE-4] re-establish a known-good baseline — germinate a fresh long-lived reference/staging platform from post-SPINE-2/3 main
open-platform/mitosis
#34 /goal /ultracode-workflows [DOM-1b] self-serve custom domains (BYOD, Vercel-style, TXT-verify + per-app issuer selection)
open-platform/mitosis
#35 /goal /ultracode-workflows [HYB-2] validate a granddaughter on a real VPS over the public internet (production TLS + edge)
open-platform/mitosis
#37 /goal /ultracode-workflows [DOM-2] swap CNI to Cilium + replace blanket app egress with domain/identity-defined CiliumNetworkPolicy (closes #13)
open-platform/mitosis
Reference
open-platform/mitosis#24
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Track/Wave:
DOM-1a· Wave M1 · Size MRepos:
gitops,mitosisDepends on: none
Why
For the first client the operator controls DNS, so the MVP does NOT need self-serve domain tooling — it needs one thing: a public, browser-trusted wildcard cert for the platform domain, replacing the private plat-local-ca-issuer every cert chains to today (gitops has NO ACME issuer at all).
Scope
A
letsencrypt-dns01DNS-01 ClusterIssuer + sops-sealed DNS-provider token underclusters/local/platform/letsencrypt/(DNS-01 so it supports wildcards and works before traffic is routed); issue a public*.<platform-domain>wildcard Certificate so every app under the platform suffix is instantly browser-trusted with ZERO per-app overlay change. acme-staging FIRST, flip to prod after E2E. mitosis: confirm the sealed DNS token flows through fork_regen_secrets/fork_verify_all_sealed; gate the ACME path behind the CUTOVER_TUNNEL-style public-edge opt-in so a purely-local daughter keeps the internal CA. This is exactly "PR 1" of the self-serve-custom-domains proposal.Acceptance
On a germinated public daughter, an app under
*.<platform-domain>serves a leaf that openssl s_client and a stock browser trust as chaining to Let's Encrypt (not plat-local-ca).Notes
Gitops-only render — NOT on the server.ts overlay seam. Seam C: adds one include line to platform/kustomization.yaml.
Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.
Build note (from DOM-1a gitops PR plat/gitops#3): the gitops half is done, but the mitosis-side sub-scope changed.
fork_regen_secretsenumerates sealed secrets EXPLICITLY (no generic reseal loop) andfork_verify_all_sealedrejects any sops-blocked file it cannot decrypt with the fork key — so a genesis-sealedcloudflare-dns-api.yamlwould ABORT daughter germination. PR#3 therefore ships the token unsealed with a placeholder (germination-safe). Remaining mitosis work for DOM-1a: add the Cloudflare DNS token to thefork_regen_secretsenumeration +fork_verify_all_sealed(bin/lib.sh, seam A) so daughters seal it per-fork, and gate ACME behind the CUTOVER_TUNNEL public-edge opt-in. Will land in the seam-A chain.Code complete + merged (gitops#3 issuer/wildcard + mitosis fork-reseal #53). Activation needs a seed refresh carrying the letsencrypt component + operator CLOUDFLARE_DNS_API_TOKEN at germination + issuer staging→prod flip. Live browser-trusted-TLS validation happens at the real Hetzner deploy. Note: with Cloudflare Tunnel the browser already gets a trusted CF edge cert (Full mode), so DOM-1a is Full-Strict origin hardening, not a first-deploy blocker.