fleet-manager: pass optional AWS_HOSTED_ZONE_ID to the acme side-car

lego auto-discovers the Route 53 zone via ListHostedZonesByName, so the zone ID is optional — but pinning it disambiguates overlapping public/private zones and lets the IAM policy drop the list permission. Thread it through compose + .env + DEPLOY.md (no script change; lego reads it from the environment).
2026-07-04 10:14:51 +00:00
parent 9479b70b04
commit 510f4f6b25
3 changed files with 12 additions and 0 deletions
@@ -120,6 +120,12 @@ instance role and omit them):
 }
 ```

+`AWS_HOSTED_ZONE_ID` is **optional**: lego auto-discovers the zone via
+`ListHostedZonesByName` (hence that statement). Set it in `.env` to pin the zone
+— required if a **public + private** zone share `bitasylum.org` (auto-discovery
+may pick the wrong one), and it lets you **drop the `ListHostedZonesByName`
+statement** for a tighter policy.
+
 **Run it** (bring the side-car up first so the cert exists before the manager):

 ```bash