/goal /ultracode-workflows [DOM-1b] self-serve custom domains (BYOD, Vercel-style, TXT-verify + per-app issuer selection) #34

New issue

Closed

opened 2026-07-01 02:03:47 +00:00 by plat · 0 comments

plat commented

2026-07-01 02:03:47 +00:00

Owner

Track/Wave: DOM-1b · Wave G2 · Size L
Repos: mcp, gitops
Depends on: DOM-1a

Why

The rest of the self-serve-custom-domains proposal beyond the ACME issuer: lets tenants bring their own domains with ownership verification. The resolution half (resolveAppHost) is already built.

Scope

Pure domains.ts helpers (addDomainLine, challengeRecordName, isPlatformHost); stateless-HMAC add_domain/verify_domain tools doing a live resolveTxt and writing clusters/local/domains.yaml via gitopsPush; issuer selection threaded into the existing overlay Certificate block (overlayManifests ~2320, no new render path); set_app_domain/set_org_domain wrappers reusing the re-host path (server.ts:2811); both tools added to authorize()'s owner-gated allowlist.

Acceptance

On a germinated daughter, add_domain → publish TXT → verify_domain writes the org→domain line; create_app(domain:) yields an Ingress host + cert issuerRef=letsencrypt-dns01 matching the single-resolved-host invariant.

Notes

Seam B (overlay renderer) — HEAD of the overlay chain. Open decisions: ACME provider; apex vs subdomain; daughters inherit vs scrub parent domains.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `DOM-1b` · Wave **G2** · Size **L** **Repos:** `mcp`, `gitops` **Depends on:** DOM-1a ## Why The rest of the self-serve-custom-domains proposal beyond the ACME issuer: lets tenants bring their own domains with ownership verification. The resolution half (resolveAppHost) is already built. ## Scope Pure domains.ts helpers (addDomainLine, challengeRecordName, isPlatformHost); stateless-HMAC add_domain/verify_domain tools doing a live resolveTxt and writing clusters/local/domains.yaml via gitopsPush; issuer selection threaded into the existing overlay Certificate block (overlayManifests ~2320, no new render path); set_app_domain/set_org_domain wrappers reusing the re-host path (server.ts:2811); both tools added to authorize()'s owner-gated allowlist. ## Acceptance On a germinated daughter, add_domain → publish TXT → verify_domain writes the org→domain line; create_app(domain:) yields an Ingress host + cert issuerRef=letsencrypt-dns01 matching the single-resolved-host invariant. ## Notes **Seam B (overlay renderer) — HEAD of the overlay chain. Open decisions: ACME provider; apex vs subdomain; daughters inherit vs scrub parent domains.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:47 +00:00

plat added the

horizon:governance

roadmap

goal

labels

2026-07-01 02:03:47 +00:00

plat added a new dependency

2026-07-01 02:04:44 +00:00

#29 /goal /ultracode-workflows [RBAC-2] forwardAuth platform-auth service + Traefik middleware (apps private by Forgejo permission, zero app auth code)

plat added a new dependency