Add cluster-managed certificate metadata support

2026-09-19 10:22:03 -04:00
parent 6cff2261d5
commit 43826bebed
4 changed files with 226 additions and 1 deletions
@@ -50,3 +50,26 @@ Requested mutations must fail closed.

 If an expected NPM source anchor cannot be identified or verification fails,
 the patcher must exit non-zero rather than start an ungated NPM backend.
+
+## Cluster-managed certificates
+
+Optional cluster-managed custom certificate support is enabled with:
+
+    ACME_CLUSTER_CERT=true
+
+This does not grant ACME authority and does not currently perform renewal.
+
+When enabled it:
+
+- adds `meta.cluster_managed` as an explicit boolean certificate property;
+- adds `meta.acme_renew` as an explicit boolean certificate property;
+- preserves the logical `domain_names` already stored on a custom certificate
+  when new certificate material is uploaded.
+
+Cluster-managed certificates remain `provider=other`.
+
+The serving certificate therefore remains under:
+
+    /data/custom_ssl/npm-<id>
+
+and is independent from any Certbot lineage under `/etc/letsencrypt`.