diff options
| author | Paul Buetow <paul@buetow.org> | 2026-08-03 10:27:49 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-08-03 10:27:49 +0300 |
| commit | a7d859681f5508a829115376d9dd993f3f137321 (patch) | |
| tree | 272a080c3a21a2345e916a961b035b3fe8b46627 /frontends/etc/acme-client.conf.tpl | |
| parent | 7785a4281d6fc2b33eae2face2505cd892d733d4 (diff) | |
frontends: give f3s hosts a standby.<host> SAN instead of a separate cert
f3s hosts don't get a distinct standby certificate/keypair; alias the
primary cert's files under the standby name (relayd selects a keypair
by SNI, so it needs matching filenames) and add standby.<host> as a
SAN on the primary cert. Every host now also gets www.<host> as a SAN
unconditionally, since public DNS publishes www for all of them.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Diffstat (limited to 'frontends/etc/acme-client.conf.tpl')
| -rw-r--r-- | frontends/etc/acme-client.conf.tpl | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/frontends/etc/acme-client.conf.tpl b/frontends/etc/acme-client.conf.tpl index 0c9671d..727e7fe 100644 --- a/frontends/etc/acme-client.conf.tpl +++ b/frontends/etc/acme-client.conf.tpl @@ -28,11 +28,12 @@ authority buypass-test { # Skip ipv4/ipv6 subdomains - they're included as SANs in parent cert next if $host =~ /^(ipv4|ipv6)\./; -%> -<% # Check if this host has ipv4/ipv6 subdomains that need to be included as SANs - my @alt_names; - # Don't add www prefix for f3s hosts - they don't have DNS records for www variants - unless (grep { $_ eq $host } @$f3s_hosts) { - push @alt_names, "www.$host"; +<% # Public DNS publishes www for every service. f3s hosts use the primary + # certificate for standby too (unlike other hosts, they do not get a + # separate standby certificate/keypair). + my @alt_names = ("www.$host"); + if (grep { $_ eq $host } @$f3s_hosts) { + push @alt_names, "standby.$host"; } for my $sub_host (@$acme_hosts) { if ($sub_host =~ /^(ipv4|ipv6)\.\Q$host\E$/) { |