atlas
fb93cbf5c2
feat: add tls.acme mode — nginx inside container manages Let's Encrypt
per mara's suggestion: instead of bind-mounting operator certs, let
nginx handle ACME directly inside the gateway container.
- tls.acme.enable: lets nginx obtain + renew via HTTP-01 challenge
- tls.acme.email: ACME account contact (required when enable=true)
- security.acme in container config when acme.enable
- hasTls includes acme.enable → https, httpsPort listen, firewall
- mutual exclusion assertions: acme vs selfSignedTls vs certDir
- docs/gateway.md: four-mode TLS table + ACME section
typical setup:
selfSignedTls = false; openFirewall = true;
tls.acme = { enable = true; email = "admin@example.com"; };
|
2026-06-03 16:46:52 +02:00 |
| .. |
|
hive-c0re.nix
|
fix: use forge domain URL + open 80/443 for isolated agents
|
2026-06-03 16:33:10 +02:00 |
|
hive-ci.nix
|
fix(#981): validate runner credentials on every boot, purge stale .runner
|
2026-06-02 00:27:47 +02:00 |
|
hive-forge.nix
|
fix(#981): enable Forgejo Actions so runner registration token API works
|
2026-06-01 18:38:44 +02:00 |
|
hive-gateway.nix
|
feat: add tls.acme mode — nginx inside container manages Let's Encrypt
|
2026-06-03 16:46:52 +02:00 |
|
hive-matrix.nix
|
fix(#1061): suppress tuwunel default displayname suffix
|
2026-06-02 11:18:38 +02:00 |
|
hive-network.nix
|
fix: assert gateway.enable when isolateContainers + forge.enable
|
2026-06-03 16:33:10 +02:00 |