From 34b87d6a52e43c8f457f0ea0b5407b34eda0e33b Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Mon, 17 Jul 2023 20:11:25 -0400 Subject: [PATCH] fix: rename bootstrap_acme_enable_production_certs var Signed-off-by: Devin Buhl --- README.md | 2 +- .../apps/networking/ingress-nginx/app/helmrelease.yaml.j2 | 2 +- .../ingress-nginx/certificates/kustomization.yaml.j2 | 2 +- bootstrap/vars/config.sample.yaml | 6 +++--- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 54c42e42..f5b26d99 100644 --- a/README.md +++ b/README.md @@ -368,7 +368,7 @@ Nothing working? That is expected, this is DNS after all! #### 📜 Certificates -By default this template will deploy a wildcard certificate with the Let's Encrypt staging servers. This is to prevent you from getting rate-limited on configuration that might not be valid on bootstrap using the production server. If you had `bootstrap_acme_enable_production_certs` set to `false` in your `bootstrap/vars/config.yaml`, make sure to switch to the Let's Encrypt production servers as outlined in that file. Do not enable the production certificate until you are sure you will keep the cluster up for more than a few hours. +By default this template will deploy a wildcard certificate with the Let's Encrypt staging servers. This is to prevent you from getting rate-limited on configuration that might not be valid on bootstrap using the production server. If you had `bootstrap_acme_production_enabled` set to `false` in your `bootstrap/vars/config.yaml`, make sure to switch to the Let's Encrypt production servers as outlined in that file. Do not enable the production certificate until you are sure you will keep the cluster up for more than a few hours. #### 🤖 Renovatebot diff --git a/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml.j2 index 5262e9ae..9f6f52b1 100644 --- a/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml.j2 @@ -61,7 +61,7 @@ spec: namespaceSelector: any: true extraArgs: - {% if bootstrap_acme_enable_production_certs | default(false) %} + {% if bootstrap_acme_production_enabled | default(false) %} default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls" {% else %} default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls" diff --git a/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml.j2 index 329596a0..81f57a48 100644 --- a/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml.j2 @@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./staging.yaml - {% if bootstrap_acme_enable_production_certs | default(false) %} + {% if bootstrap_acme_production_enabled | default(false) %} - ./production.yaml {% endif %} diff --git a/bootstrap/vars/config.sample.yaml b/bootstrap/vars/config.sample.yaml index dfcb007e..64a59ede 100644 --- a/bootstrap/vars/config.sample.yaml +++ b/bootstrap/vars/config.sample.yaml @@ -13,12 +13,12 @@ bootstrap_age_public_key: bootstrap_timezone: Etc/UTC # Email you want to be associated with the ACME account (used for TLS certificates via letsencrypt.org) bootstrap_acme_email: -# Use ACME production servers when requesting the wildcard certificate -# The default here is `false` which means ACME staging certs will be used instead +# Use the ACME production env when requesting the wildcard certificate, +# the default here is `false` which means ACME staging env will be used instead. # This is to prevent being rate-limited. Update this option to `true` when you # have verified the staging certificate works and then re-run `task configure` # and push your changes to Github. -bootstrap_acme_enable_production_certs: false +bootstrap_acme_production_enabled: false # Flux github webhook token (openssl rand -hex 12) bootstrap_flux_github_webhook_token: