diff options
| author | Paul Buetow <paul@buetow.org> | 2026-08-03 13:13:05 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-08-03 13:13:05 +0300 |
| commit | 5147db7a3e2902392206970513ffa95009b100ae (patch) | |
| tree | 8304d4b89c89a203dc99411a9a99819ac46a43bd /frontends/etc/acme-client.conf.tpl | |
| parent | a7d859681f5508a829115376d9dd993f3f137321 (diff) | |
frontends: restore standalone standby certificates
Amp-Thread-ID: https://ampcode.com/threads/T-019fc408-6e41-73fe-826d-d47b0408981b
Co-authored-by: Amp <amp@ampcode.com>
Diffstat (limited to 'frontends/etc/acme-client.conf.tpl')
| -rw-r--r-- | frontends/etc/acme-client.conf.tpl | 10 |
1 files changed, 2 insertions, 8 deletions
diff --git a/frontends/etc/acme-client.conf.tpl b/frontends/etc/acme-client.conf.tpl index 727e7fe..144f800 100644 --- a/frontends/etc/acme-client.conf.tpl +++ b/frontends/etc/acme-client.conf.tpl @@ -28,13 +28,9 @@ authority buypass-test { # Skip ipv4/ipv6 subdomains - they're included as SANs in parent cert next if $host =~ /^(ipv4|ipv6)\./; -%> -<% # Public DNS publishes www for every service. f3s hosts use the primary - # certificate for standby too (unlike other hosts, they do not get a - # separate standby certificate/keypair). +<% # Public DNS publishes www for every service. Standby names resolve to + # the other frontend, so they need their own certificate/keypair. my @alt_names = ("www.$host"); - if (grep { $_ eq $host } @$f3s_hosts) { - push @alt_names, "standby.$host"; - } for my $sub_host (@$acme_hosts) { if ($sub_host =~ /^(ipv4|ipv6)\.\Q$host\E$/) { push @alt_names, $sub_host; @@ -48,14 +44,12 @@ domain <%= $host %> { domain full chain certificate "/etc/ssl/<%= $host %>.fullchain.pem" sign with letsencrypt } -<% unless (grep { $_ eq $host } @$f3s_hosts) { -%> domain standby.<%= $host %> { domain key "/etc/ssl/private/standby.<%= $host %>.key" domain full chain certificate "/etc/ssl/standby.<%= $host %>.fullchain.pem" sign with letsencrypt } <% } -%> -<% } -%> # Current server's FQDN (blowfish.buetow.org or fishfinger.buetow.org) # Each server only has its own cert, no www/standby variants for server hostnames |