scottyah/fit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Let cert-manager issue the certificate
All checks were successful
Build and Deploy / build-and-deploy (push) Successful in 56s
Details

Browse Source 
The ingress pointed at scottyah-tls, a secret hand-copied between
namespaces and absent from this one, so Traefik fell back to a
self-signed certificate. That is invisible behind Cloudflare until the
SSL mode is set to Full (strict), which then fails with a 526.

Issue into the namespace over DNS-01 instead. Nothing to copy, and the
renewal is no longer a thing anyone has to remember.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
scott
2026-08-01 22:30:47 -07:00
parent 3168a4ef96
commit 81d795955d
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -81,8 +81,13 @@ kubectl create secret generic fit-basic-auth -n fit --from-file=users=/tmp/users
rm /tmp/users
```
Point `fit.scottyah.com` at the cluster and Traefik terminates TLS with the
existing `scottyah-tls` secret.
Point `fit.scottyah.com` at the cluster. The certificate is issued by
cert-manager through the `letsencrypt-prod-cloudflare` cluster issuer, which
solves a DNS-01 challenge at Cloudflare and writes `fit-tls` into this
namespace. Nothing is copied in and nothing is renewed by hand.
Cloudflare's SSL mode should be Full (strict). Flexible carries the basic-auth
password to the origin in the clear, and it rides on every request.
To pull a copy of the log without the browser: