rcourtman 4885c378aa Keep the operator .env out of the Traefik container and unhardcode the DNS-01 provider ...

Traefik took the whole operator .env via env_file, so the internet-facing
container's environment carried CP_ADMIN_KEY and the entitlement signing
private key, neither of which it needs. It now receives only ACME/DNS
material: the CF token by explicit passthrough plus an optional
dns-credentials.env that setup.sh creates 0600.

The same wiring removes the silent Cloudflare-only narrowing: the resolver
provider is now ACME_DNS_PROVIDER (default cloudflare) via Traefik's env
override, the CF token is required only for the default provider, and any
other Traefik dnsChallenge provider supplies its credential variables through
dns-credentials.env. Pinned by
TestProviderMSPTraefikEnvIsMinimalAndDNSProviderOverridable; contract delta
in deployment-installability.

2026-08-07 10:47:13 +01:00

..

helm/pulse

Prepare v6.2.0-rc.9 release

2026-08-07 10:03:16 +01:00

provider-msp

Keep the operator .env out of the Traefik container and unhardcode the DNS-01 provider

2026-08-07 10:47:13 +01:00