sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: pass optional AWS_HOSTED_ZONE_ID to the acme side-car

Browse Source 
lego auto-discovers the Route 53 zone via ListHostedZonesByName, so the zone ID
is optional — but pinning it disambiguates overlapping public/private zones and
lets the IAM policy drop the list permission. Thread it through compose + .env
+ DEPLOY.md (no script change; lego reads it from the environment).
This commit is contained in:
Audiobuzz
2026-07-04 10:14:51 +00:00
parent 9479b70b04
commit 510f4f6b25
3 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/.env.example
+3
View File
@@ -28,6 +28,9 @@ ACME_EMAIL=you@bitasylum.org
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=us-east-1
# Optional but recommended: pin the Route 53 zone. Skips ListHostedZonesByName
# (so you can drop it from the IAM policy) and disambiguates public/private zones.
AWS_HOSTED_ZONE_ID=
# ACME_STAGING=1 # uncomment for a dry-run vs LE staging (UNTRUSTED certs, no rate limit)
# --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------