mrcharles
2161ce64c2
v10/v11 archived under archive/questions/; carried opens mapped to tickets #800-#807. https://projects.knownelement.com/issues/769
22 lines
860 B
Markdown
22 lines
860 B
Markdown
# Questions — v11 (current round)
|
|
|
|
New round opened by the 09-04 night grind (monitoring wiring t/335 EXECUTED;
|
|
apt-satellite lane LIVE; CA/ACME pilot done). Two gating questions for the
|
|
next phase. One-line answers fine. (v10 + history: archive/questions/)
|
|
|
|
## CA/ACME phase B (t/327 design)
|
|
|
|
**Q1 (DNS-01 for the fleet ACME).** The prod ACME endpoint on tsys-ca (phase
|
|
B) needs to validate knel.net identifiers. Recommended: **DNS-01 via
|
|
Technitium** — may I generate a TSIG key scoped to `_acme-challenge.*`
|
|
updates and load it on tsys-dns (one config edit + git SoR sync), or prefer
|
|
HTTP-01 only for now?
|
|
|
|
A: approved
|
|
|
|
**Q2 (step-ca go on tsys-ca).** Deploy the prod ACME container on the tsys-ca
|
|
VM (new container, intermediate signed by the existing fleet root, bound to
|
|
the Tailscale IP :8443) — approve to start, or pick a window?
|
|
|
|
A: approved.
|