k3s-edge.nix:
- Added 'ca https://acme-v02.api.letsencrypt.org/directory' to porkbun_tls snippet
- Forces production LE instead of staging
fix-racknerd-tls.sh:
- Checks current Porkbun keys (redacted)
- Verifies production LE CA is configured
- Provides deploy and restart instructions
- Documents how to update Porkbun API keys via sops
Edge Caddy now does exactly three things:
1. Terminate TLS for researchstack.info + *.researchstack.info via
Porkbun DNS-01 (wildcard cert covers all subdomains in one renewal)
2. 301-redirect legacy subdomains to canonical path equivalents:
status.* → /server/status/
dash.*, home.* → /
media.* → /apps/jellyfin/
books.* → /apps/books/
music.* → /apps/music/
vault.* → /server/vault/
pulse.* → /api/registry/
apps.* → /apps/
*.* (wildcard fallback) → /
3. Forward all other traffic to the internal router (host Caddy :80 on
k3s-server over Tailscale) with X-Forwarded-* headers preserved.
auth.* and mail/webmail.* are forwarded unchanged (stable subdomains).
No path routing logic on the edge. Traefik Ingress (k3s-server) owns
all path decisions. This commit has no effect until nixos-rebuild switch
is run on microvm-racknerd (deploy after k3s-server is verified).
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
