The WAN is on DHCP with no DDNS anywhere, so a lease change would break
public DNS silently -- certs, Plex and Gitea SSH all resolve through
aleshym.co. cert-manager's Cloudflare token only ever writes the
_acme-challenge TXT records and never touches the A record.
Reuses that same token, resealed for this namespace: its Zone:DNS:Edit
scope already covers A records (verified against the live API).
The updater only PATCHes when the record is actually stale, and PATCHes
content alone so the proxied flag and TTL stay as configured. It exits
non-zero on any failure so a broken run surfaces as a Failed job rather
than dying quietly -- silent failure is the thing this exists to prevent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Secrets are now committed encrypted (sealed-secrets v0.38.4) instead of
hand-applied out-of-band, closing the config-DR gap the backups intentionally
don't cover. Existing Secret adopted via the managed annotation (values verified
unchanged). Controller private key backed up GPG-encrypted off-cluster.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
funman300