- Shipped
- June 8, 2026 at 2:32 AM UTC
- Author
- Kamo
- Commit
- 20e1d3e
Custom org domains (e.g. login.sign.pink) returned Traefik's bare "404 page not found" over plain HTTP: the only port-80 redirect router was hardcoded to *.kamocrm.com, and **************** was never applied by the deploy workflow, so the cluster ran a stale manual apply. HTTPS worked (domain-agnostic routes) but browsers hit HTTP first. - **************** match HostRegexp(`^.+$`) for all hosts, exclude /.well-known/acme-challenge/ (HTTP-01 must stay on HTTP), priority 1 so theme/cockroach/mail web routes still win. - deploy-services.yml: actually apply http-to-https-redirect.yaml (it was missing from the kubectl apply list, hence the drift); restart auto-cert so ConfigMap script changes take effect. Also fixes cert issuance starvation: auto-cert minted a Let's Encrypt order for every RequestHost in Traefik's access logs, so internet scanners (forbes.com, ip-api.com, ...) flooded cert-manager and the shared ACME account, blocking real domains like sign.pink from issuing. - auto-cert: require each dynamically-discovered host to be a registered org domain (SecurityService /api/security/org/domain) before requesting a cert; static/platform apexes (*.sign.pink, *.priceturbo.com, *.kamocrm.com) always allowed; fail-closed (skip, retry) when the registry is unreachable. - auto-cert: sweep stale Certificates for non-org hosts (404 + not Ready) at startup and every ~30 min; +delete RBAC for that cleanup.