feat(platform): caddyAcme TLS mode — Caddy edge with TLS-ALPN-01 - #11
Open
1456055067 wants to merge 2 commits into
Open
feat(platform): caddyAcme TLS mode — Caddy edge with TLS-ALPN-01#111456055067 wants to merge 2 commits into
1456055067 wants to merge 2 commits into
Conversation
Add tls.mode: certManager | caddyAcme. caddyAcme makes Caddy the edge: windep-web runs Caddy (instead of nginx) and the admin pod gets a Caddy sidecar. Caddy obtains public certs via ACME TLS-ALPN-01 (certmagic, HA across the deploy replicas via a shared RWX PVC) against the internal ACME CA, serves the payload tree, and reverse-proxies to the Go apps, which run plaintext behind it. cert-manager is not rendered in this mode. - New: images.caddy, caddyAcme.* values; web Caddy deployment + Caddyfile ConfigMap + certmagic RWX PVC; admin Caddy sidecar + Caddyfile; api/admin run plaintext (LISTEN_ADDR/no TLS env) in caddyAcme. - Existing certManager path unchanged (default); mode-gated templates. - Parity preserved: anycast labels + both VIPs, admin NetworkPolicy, api ClusterIP. Verified helm lint + template for both modes / both site values. - Docs: platform/README.md TLS-modes section; platform/docs/caddy-tls-alpn.drawio. Backend mTLS (edge->api/admin, api->admin) is a follow-up (app-level mTLS in the Go services); the caddyAcme backend hop is plaintext for now.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #10 (base:
helm-chart). PR A of the TLS-ALPN-01 + mTLS plan — the edge; backend mTLS follows in PR B.What
Adds
tls.mode: certManager | caddyAcmeto the chart.caddyAcmemakes Caddy the edge:windep-webruns Caddy instead of nginx — serves the payload tree (file_server), reverse-proxies/api/*towindep-api, and obtains public certs via ACME TLS-ALPN-01 (certmagic).windep-api,admin) run plaintext behind Caddy — no code changes (they already supportLISTEN_ADDRwithout TLS).certManager(default) is unchanged from #10, so this is additive.Why Caddy (recap of the design thread)
cert-manager can't do TLS-ALPN-01; per-backend self-issuance breaks under multi-replica anycast (challenge sprays across replicas, Go
autocerthas no distributed solving). Caddy/certmagic with shared storage is the HA-safe way to run TLS-ALPN-01 here.Parity / safety
windep.dev/lb-anycastlabels + both VIP annotations, admin NetworkPolicy (incl. api→admin ingest rule), and apiClusterIPall preserved.helm lint+helm templatefor both modes and both site value files. Rendered Caddyfiles inspected. Resource counts: certManager 20 (unchanged), caddyAcme 18.Prereqs for caddyAcme (documented in README)
images.caddy— prefer Iron Bank; verify Repo One availability).caddyAcme.caRootSecret, keyca.crt) Caddy trusts for the ACME directory.Not in this PR
Backend mTLS (edge→api/admin, api→admin) — the caddyAcme backend hop is plaintext on the pod network today. App-level mTLS in the Go services is PR B (Go source + cert-manager CA issuer + image bumps), per the approved plan.
Diagram:
platform/docs/caddy-tls-alpn.drawio.