From 510f4f6b25d51896faca45c18555bd680e617f53 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sat, 4 Jul 2026 10:14:51 +0000 Subject: [PATCH] fleet-manager: pass optional AWS_HOSTED_ZONE_ID to the acme side-car MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit lego auto-discovers the Route 53 zone via ListHostedZonesByName, so the zone ID is optional — but pinning it disambiguates overlapping public/private zones and lets the IAM policy drop the list permission. Thread it through compose + .env + DEPLOY.md (no script change; lego reads it from the environment). --- serving/fleet-manager/.env.example | 3 +++ serving/fleet-manager/DEPLOY.md | 6 ++++++ serving/fleet-manager/docker-compose.yml | 3 +++ 3 files changed, 12 insertions(+) diff --git a/serving/fleet-manager/.env.example b/serving/fleet-manager/.env.example index 365b8ed..c8b1c55 100644 --- a/serving/fleet-manager/.env.example +++ b/serving/fleet-manager/.env.example @@ -28,6 +28,9 @@ ACME_EMAIL=you@bitasylum.org AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY= AWS_REGION=us-east-1 +# Optional but recommended: pin the Route 53 zone. Skips ListHostedZonesByName +# (so you can drop it from the IAM policy) and disambiguates public/private zones. +AWS_HOSTED_ZONE_ID= # ACME_STAGING=1 # uncomment for a dry-run vs LE staging (UNTRUSTED certs, no rate limit) # --- agent plane (gRPC + mTLS, fleet CA) --------------------------------------- diff --git a/serving/fleet-manager/DEPLOY.md b/serving/fleet-manager/DEPLOY.md index b8c7365..a670a88 100644 --- a/serving/fleet-manager/DEPLOY.md +++ b/serving/fleet-manager/DEPLOY.md @@ -120,6 +120,12 @@ instance role and omit them): } ``` +`AWS_HOSTED_ZONE_ID` is **optional**: lego auto-discovers the zone via +`ListHostedZonesByName` (hence that statement). Set it in `.env` to pin the zone +— required if a **public + private** zone share `bitasylum.org` (auto-discovery +may pick the wrong one), and it lets you **drop the `ListHostedZonesByName` +statement** for a tighter policy. + **Run it** (bring the side-car up first so the cert exists before the manager): ```bash diff --git a/serving/fleet-manager/docker-compose.yml b/serving/fleet-manager/docker-compose.yml index 527edd4..a01f3e9 100644 --- a/serving/fleet-manager/docker-compose.yml +++ b/serving/fleet-manager/docker-compose.yml @@ -129,6 +129,9 @@ services: AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID:-}" AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY:-}" AWS_REGION: "${AWS_REGION:-us-east-1}" + # Optional: pin the zone (skips the ListHostedZonesByName lookup — needed if + # a public + private zone share the domain; lets you tighten the IAM policy). + AWS_HOSTED_ZONE_ID: "${AWS_HOSTED_ZONE_ID:-}" volumes: - ./acme/renew-loop.sh:/renew-loop.sh:ro - acme-state:/le # lego account + cert store — PERSIST