From 6d39028e2fb58c57f2ba1bc1fa57999ab653f59a Mon Sep 17 00:00:00 2001 From: Aleksandr Bogomiakov Date: Tue, 6 Oct 2026 17:57:36 +0100 Subject: [PATCH] NG: HTTP-01 fallback solver for domains outside the DNS-01 zones Co-Authored-By: Claude --- k8s-ng/core/cert-manager/issuer.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/k8s-ng/core/cert-manager/issuer.yaml b/k8s-ng/core/cert-manager/issuer.yaml index 154330b..e84ac08 100644 --- a/k8s-ng/core/cert-manager/issuer.yaml +++ b/k8s-ng/core/cert-manager/issuer.yaml @@ -1,4 +1,5 @@ -# Public certificates through DNS-01. The credential Secrets are created by hand +# Public certificates through DNS-01 for the zones below and HTTP-01 (Traefik) for +# every other domain, e.g. the .рф one. The credential Secrets are created by hand # (they will move to Vaultwarden + External Secrets): # kubectl -n cert-manager create secret generic cloudflare-api-token --from-literal=apiToken= # (Zone:DNS:Edit on the btwiusearch.net zone) @@ -36,3 +37,8 @@ spec: secretAccessKeySecretRef: name: aws-api-key-secret key: secretKey + # Fallback for domains outside the zones above: their A records must point + # at the cluster nodes (Traefik answers on port 80 everywhere). + - http01: + ingress: + ingressClassName: traefik