sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: point acme DNS-01 propagation check at a public resolver

Browse Source 
Split-horizon DNS made lego's propagation check query the container's internal
resolver, which doesn't serve the public _acme-challenge TXT record, so the
challenge timed out. Add ACME_RESOLVERS (comma-separated host:port, default
8.8.8.8:53) → one --dns.resolvers flag each. Documented in .env + DEPLOY.md.
This commit is contained in:
Audiobuzz
2026-07-04 10:24:42 +00:00
parent d31c0f18eb
commit 693cf94695
4 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/DEPLOY.md
+6
View File
@@ -151,6 +151,12 @@ A publicly-trusted cert also keeps the WebAuthn secure-context clean (no browser
warnings). The side-car keeps renewing on its 12-hour loop; the manager reloads
each new cert automatically.
> **Split-horizon DNS:** the side-car defaults `ACME_RESOLVERS=8.8.8.8:53` so
> lego checks TXT propagation against **public** DNS. Without it, lego uses the
> container's internal resolver, which doesn't serve the public
> `_acme-challenge` record, and the challenge times out. Override if 8.8.8.8 is
> blocked (e.g. `1.1.1.1:53`, comma-separated for several).
> **Origin match:** the cert CN/SAN (`FLEET_MGR_RP_ID`) must equal the origin the
> browser uses *and* `FLEET_MGR_RP_ORIGIN` — passkeys are origin-bound. The admin
> listener binds loopback (`127.0.0.1:9500`) by default; expose it as