feat: add bootstrap_acme_enable_production_certs config var

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/templates/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
@@ -60,7 +61,11 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
+        {% if bootstrap_acme_enable_production_certs | default(false) %}
+        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
+        {% else %}
         default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls"
+        {% endif %}
       resources:
         requests:
           cpu: 10m

bootstrap/templates/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml.j2

@@ -1,6 +1,9 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./staging.yaml
-  # - ./production.yaml
+  {% if bootstrap_acme_enable_production_certs | default(false) %}
+  - ./production.yaml
+  {% endif %}

bootstrap/vars/config.sample.yaml

@@ -13,6 +13,12 @@ bootstrap_age_public_key:
 bootstrap_timezone: Etc/UTC
 # Email you want to be associated with the ACME account (used for TLS certificates via letsencrypt.org)
 bootstrap_acme_email:
+# Use ACME production servers when requesting the wildcard certificate
+# The default here is `false` which means ACME staging certs will be used instead
+# This is to prevent being rate-limited. Update this option to `true` when you
+# have verified the staging certificate works and then re-run `task configure`
+# and push your changes to Github.
+bootstrap_acme_enable_production_certs: false
 
 # Flux github webhook token (openssl rand -hex 12)
 bootstrap_flux_github_webhook_token: