sjat 6e38693499 feat(reverse_proxy): optional ACME DNS-01 via Gandi (wildcard / LAN-only) ... Adds a per-instance DNS-01 mode to the Caddy role for mesh/LAN-only hosts that cannot satisfy HTTP-01. Default behaviour (vanilla caddy:2 + HTTP-01, what askari runs) is unchanged. - reverse_proxy__acme_dns_provider: "" (HTTP-01) | "gandi" (DNS-01) - reverse_proxy__image: override to the custom caddy-gandi image for DNS-01 - Caddyfile gains a global `acme_dns gandi {env.GANDI_BEARER_TOKEN}` block - the PAT (vault.gandi.pat) renders into a host-only 0600 env file (no_log), loaded by compose only when DNS-01 is enabled Verified: the custom image issues a real wildcard cert (*.dns01test.wingu.me) end-to-end against LE staging via Gandi DNS-01; `caddy validate` accepts `acme_dns gandi` on the custom image and rejects it on vanilla caddy:2. Molecule (HTTP-01 default path) green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-15 06:57:47 +02:00
..
main.yml	feat(reverse_proxy): optional ACME DNS-01 via Gandi (wildcard / LAN-only)	2026-06-15 06:57:47 +02:00