# step-ca PROD ACME endpoint on tsys-ca [#800 #697]
#
# Bring-your-own-chain: intermediate signed by the fleet root (offline
# /root/ca-root), served on the TAILNET only. HTTP-01 challenges do NOT hit
# this box — ACME clients serve them on the target host's port 80.
#
# Files expected next to this compose (created by init-stepca.sh):
#   data/          step home (config, certs, secrets; uid 1000)
# Init (first deploy only): bash init-stepca.sh   (run on tsys-ca as root)
# Verify:  curl -k https://100.102.96.24:8443/acme/acme/directory
#
# PROVISIONER: ACME provisioner named "acme" is added by init-stepca.sh
# (step ca provisioner add acme --type ACME) after scaffolding.

services:
  stepca:
    image: smallstep/step-ca@sha256:e9e8fa3262bf37b130962ffddbf6a64ac188f0bbb80959cf3ddc04c6bf294c3d
    container_name: ukrrs-oam-ca-stepca
    restart: unless-stopped
    # step-ca validates http-01 by dialing the ROOTED target name; docker's
    # embedded DNS on tsys-ca cannot answer absolute tailnet FQDNs, so pin
    # the tailscale resolver (MagicDNS) explicitly.
    network_mode: host
    volumes:
      - ./data:/home/step
    # hardening (read_only+caps) re-enabled after validation debugging