sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: point acme DNS-01 propagation check at a public resolver

Browse Source 
Split-horizon DNS made lego's propagation check query the container's internal
resolver, which doesn't serve the public _acme-challenge TXT record, so the
challenge timed out. Add ACME_RESOLVERS (comma-separated host:port, default
8.8.8.8:53) → one --dns.resolvers flag each. Documented in .env + DEPLOY.md.
This commit is contained in:
Audiobuzz
2026-07-04 10:24:42 +00:00
parent d31c0f18eb
commit 693cf94695
4 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/.env.example
+4
View File
@@ -31,6 +31,10 @@ AWS_REGION=us-east-1
# Optional but recommended: pin the Route 53 zone. Skips ListHostedZonesByName
# (so you can drop it from the IAM policy) and disambiguates public/private zones.
AWS_HOSTED_ZONE_ID=
# Public resolver(s) for the DNS-01 propagation check (comma-separated host:port).
# Needed because internal/split-horizon DNS won't resolve the public challenge
# record. Defaults to Google DNS; override if 8.8.8.8 is blocked (e.g. 1.1.1.1:53).
ACME_RESOLVERS=8.8.8.8:53
# ACME_STAGING=1 # uncomment for a dry-run vs LE staging (UNTRUSTED certs, no rate limit)
# --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------