mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 10:35:51 +00:00
4885c378aa
Traefik took the whole operator .env via env_file, so the internet-facing container's environment carried CP_ADMIN_KEY and the entitlement signing private key, neither of which it needs. It now receives only ACME/DNS material: the CF token by explicit passthrough plus an optional dns-credentials.env that setup.sh creates 0600. The same wiring removes the silent Cloudflare-only narrowing: the resolver provider is now ACME_DNS_PROVIDER (default cloudflare) via Traefik's env override, the CF token is required only for the default provider, and any other Traefik dnsChallenge provider supplies its credential variables through dns-credentials.env. Pinned by TestProviderMSPTraefikEnvIsMinimalAndDNSProviderOverridable; contract delta in deployment-installability.