From a7d859681f5508a829115376d9dd993f3f137321 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Mon, 3 Aug 2026 10:27:49 +0300 Subject: frontends: give f3s hosts a standby. SAN instead of a separate cert f3s hosts don't get a distinct standby certificate/keypair; alias the primary cert's files under the standby name (relayd selects a keypair by SNI, so it needs matching filenames) and add standby. as a SAN on the primary cert. Every host now also gets www. as a SAN unconditionally, since public DNS publishes www for all of them. Co-Authored-By: Claude Sonnet 5 --- frontends/Rexfile | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'frontends/Rexfile') diff --git a/frontends/Rexfile b/frontends/Rexfile index 21c2f58..3dd3c43 100644 --- a/frontends/Rexfile +++ b/frontends/Rexfile @@ -296,13 +296,21 @@ task 'acme', group => 'frontends', sub { file '/etc/acme-client.conf', - content => template( './etc/acme-client.conf.tpl', acme_hosts => \@acme_hosts ), + content => template( + './etc/acme-client.conf.tpl', + acme_hosts => \@acme_hosts, + f3s_hosts => \@f3s_hosts + ), owner => 'root', group => 'wheel', mode => '644'; file '/usr/local/bin/acme.sh', - content => template( './scripts/acme.sh.tpl', acme_hosts => \@acme_hosts ), + content => template( + './scripts/acme.sh.tpl', + acme_hosts => \@acme_hosts, + f3s_hosts => \@f3s_hosts + ), owner => 'root', group => 'wheel', mode => '744'; -- cgit v1.2.3