DOM-1a: fork-reseal cloudflare-dns-api token per daughter (#24) #53

Merged
plat merged 1 commit from feat/dom-1a-fork-reseal-cloudflare-token into main 2026-07-01 14:17:17 +00:00
Owner

Completes the mitosis side of DOM-1a (gitops#3 merged). fork_regen_secrets seals CLOUDFLARE_DNS_API_TOKEN into the letsencrypt cloudflare-dns-api secret per fork; guarded by file-presence so it no-ops on seeds without the letsencrypt component. Functionally validated with real sops+age on the vxrail (sealed + decrypts to the token with the fork key). Activates on a seed refresh carrying gitops#3; supply CLOUDFLARE_DNS_API_TOKEN at germination for public ACME TLS.

Completes the mitosis side of DOM-1a (gitops#3 merged). fork_regen_secrets seals CLOUDFLARE_DNS_API_TOKEN into the letsencrypt cloudflare-dns-api secret per fork; guarded by file-presence so it no-ops on seeds without the letsencrypt component. Functionally validated with real sops+age on the vxrail (sealed + decrypts to the token with the fork key). Activates on a seed refresh carrying gitops#3; supply CLOUDFLARE_DNS_API_TOKEN at germination for public ACME TLS.
plat merged commit 8084791854 into main 2026-07-01 14:17:17 +00:00
Sign in to join this conversation.
No description provided.