wild-cloud/wild-central
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix cert auto-provisioning to check wildcard coverage before provisioning

Browse Source 
The auto-provisioner was checking for individual cert files (e.g.,
git.civilsociety.dev.pem) without checking if a wildcard cert already
covers the domain (*.civilsociety.dev.pem). This caused redundant
individual certs to be provisioned for domains already covered by
a wildcard.

Now uses hasCertForDomain() which checks both individual AND wildcard
cert coverage before deciding a cert is missing.
This commit is contained in:
Paul Payne
2026-07-14 12:10:49 +00:00
parent 947991da7f
commit 8dd9e117bc
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
internal/reconcile/reconciler.go
View File

@@ -431,19 +431,21 @@ func (r *Reconciler) ensureTLSCerts(globalCfg *config.State, doms []domains.Doma
gatewayDomain = parts[1] gatewayDomain = parts[1]
} }
// Collect unique missing certs (wildcard or individual) // Collect unique missing certs. Use hasCertForDomain which checks
// both individual certs AND wildcard coverage (e.g., *.civilsociety.dev
// covers git.civilsociety.dev — no individual cert needed).
missing := map[string]bool{} missing := map[string]bool{}
for _, dom := range doms { for _, dom := range doms {
if dom.TLS != domains.TLSTerminate || dom.DomainName == "" { if dom.TLS != domains.TLSTerminate || dom.DomainName == "" {
continue continue
} }
if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) { if hasCertForDomain(dom.DomainName) {
if _, err := os.Stat(certbot.HAProxyCertPath(gatewayDomain)); err != nil {
missing["*."+gatewayDomain] = true
}
continue continue
} }
if _, err := os.Stat(certbot.HAProxyCertPath(dom.DomainName)); err != nil { // Determine what cert to provision: wildcard for gateway subdomains, individual otherwise
if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) {
missing["*."+gatewayDomain] = true
} else {
missing[dom.DomainName] = true missing[dom.DomainName] = true
} }
} }