carlos / platform Public

docs: wildcard-cert env vocabulary in the agent env block

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 2 months ago 0d8ab512dcefbff90e8c2586f2bf865e8e4ef3ed parent bbd3f14

2 files changed, +8 −1

diff --git a/docs/superpowers/specs/2026-08-05-wildcard-certs-design.md b/docs/superpowers/specs/2026-08-05-wildcard-certs-design.md

index 16e20c57e..5ce7500df 100644

--- a/docs/superpowers/specs/2026-08-05-wildcard-certs-design.md

+++ b/docs/superpowers/specs/2026-08-05-wildcard-certs-design.md

@@ -1,7 +1,7 @@

# Wildcard certs for instant app hostnames

**Date:** 2026-08-05

-**Status:** Approved

+**Status:** Implemented (this branch)

## Problem

diff --git a/internal/host/agent.go b/internal/host/agent.go

index 9986b7909..f54754256 100644

--- a/internal/host/agent.go

+++ b/internal/host/agent.go

@@ -56,6 +56,13 @@

// platform domains minted, no bucket manifests read, no health stamps —

// zero behavior change, same litestream-convention gate as the loops

// above.

+// - CARLOS_WILDCARD_DOMAINS — comma list of static wildcard-cert parent

+// domains for the edge (tito: go.tito.io); per-account parents under

+// PLATFORM_APPS_DOMAIN are derived automatically (edge wildcard.go)

+// - CARLOS_DNS_PROVIDER / CARLOS_DNSIMPLE_TOKEN — DNS-01 backend for

+// wildcard certs: unset/dnsimple needs the token (SSM → unit env),

+// route53 rides the box IAM role; nothing set = wildcards off,

+// per-host HTTP-01 only

// - PLATFORM_EDGE_IPS — comma-separated edge IPs custom-domain DNS checks

// compare against. Default: this box's public IPv4 from IMDS

// (best-effort; if neither is knowable, DNS stamping stands down