fleet-manager: pass optional AWS_HOSTED_ZONE_ID to the acme side-car

lego auto-discovers the Route 53 zone via ListHostedZonesByName, so the zone ID is optional — but pinning it disambiguates overlapping public/private zones and lets the IAM policy drop the list permission. Thread it through compose + .env + DEPLOY.md (no script change; lego reads it from the environment).
2026-07-04 10:14:51 +00:00
parent 9479b70b04
commit 510f4f6b25
3 changed files with 12 additions and 0 deletions
@@ -129,6 +129,9 @@ services:
      AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID:-}"
      AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY:-}"
      AWS_REGION: "${AWS_REGION:-us-east-1}"
+      # Optional: pin the zone (skips the ListHostedZonesByName lookup — needed if
+      # a public + private zone share the domain; lets you tighten the IAM policy).
+      AWS_HOSTED_ZONE_ID: "${AWS_HOSTED_ZONE_ID:-}"
    volumes:
      - ./acme/renew-loop.sh:/renew-loop.sh:ro
      - acme-state:/le               # lego account + cert store — PERSIST