KNELPFVCluster/questions-v11.md

Questions — v11 (current round)

New round opened by the 09-04 night grind (monitoring wiring t/335 EXECUTED; apt-satellite lane LIVE; CA/ACME pilot done). Two gating questions for the next phase. One-line answers fine. (v10 + history: archive/questions/)

CA/ACME phase B (t/327 design)

Q1 (DNS-01 for the fleet ACME). The prod ACME endpoint on tsys-ca (phase B) needs to validate knel.net identifiers. Recommended: DNS-01 via Technitium — may I generate a TSIG key scoped to _acme-challenge.* updates and load it on tsys-dns (one config edit + git SoR sync), or prefer HTTP-01 only for now?

Q2 (step-ca go on tsys-ca). Deploy the prod ACME container on the tsys-ca VM (new container, intermediate signed by the existing fleet root, bound to the Tailscale IP :8443) — approve to start, or pick a window?