amadan
edge: CARLOS_ACME_DELEGATION_ZONE names the delegation zone; claim-derived source arrives with Plan C
2 files changed,
+21
−0
internal/edge/wildcard.go+6 −0internal/edge/wildcard_test.go+15 −0
diff --git a/internal/edge/wildcard.go b/internal/edge/wildcard.go| index ff76decc9..fee78814e 100644 |
| --- a/internal/edge/wildcard.go |
| +++ b/internal/edge/wildcard.go |
| @@ -287,6 +287,9 @@ func (w *wildcardManager) challengeFQDN(parent string) string { |
| return "_acme-challenge." + parent |
| } |
| +// isDelegated checks delegatedSet membership only — if a parent is ever |
| +// both platform-derived and claim-derived, delegated status wins and its |
| +// challenge publishes to the delegation zone. |
| func (w *wildcardManager) isDelegated(parent string) bool { |
| w.mu.Lock() |
| defer w.mu.Unlock() |
| @@ -581,6 +584,9 @@ func newWildcardFromEnv(e *Edge, cache autocert.Cache) *wildcardManager { |
| log.Printf("edge: wildcard certs off (%s) — per-host issuance continues", reason) |
| return nil |
| } |
| + // Delegated parents (spec §4): the SOURCE is claim-derived and lands |
| + // with the claim-derivation pass (Plan C); until then the zone is |
| + // configured but the set is empty — inert by construction. |
| return newWildcardManager(static, appsDomain, e.currentHosts, nil, os.Getenv("CARLOS_ACME_DELEGATION_ZONE"), cache, dns) |
| } |
diff --git a/internal/edge/wildcard_test.go b/internal/edge/wildcard_test.go| index 73c607fe5..5bc537c3d 100644 |
| --- a/internal/edge/wildcard_test.go |
| +++ b/internal/edge/wildcard_test.go |
| @@ -480,3 +480,18 @@ func TestNilDelegatedSourceIsFine(t *testing.T) { |
| t.Errorf("%q, want %q", got, want) |
| } |
| } |
| + |
| +func TestNewWildcardFromEnvDelegationZone(t *testing.T) { |
| + t.Setenv("CARLOS_WILDCARD_DOMAINS", "go.tito.io") |
| + t.Setenv("CARLOS_DNS_PROVIDER", "dnsimple") |
| + t.Setenv("CARLOS_DNSIMPLE_TOKEN", "test-token") |
| + t.Setenv("CARLOS_ACME_DELEGATION_ZONE", " Acme.OnCarlos.Com ") |
| + e := &Edge{} |
| + w := newWildcardFromEnv(e, autocert.DirCache(t.TempDir())) |
| + if w == nil { |
| + t.Fatal("manager should be on") |
| + } |
| + if w.delegationZone != "acme.oncarlos.com" { |
| + t.Errorf("delegationZone = %q, want lowercased+trimmed acme.oncarlos.com", w.delegationZone) |
| + } |
| +} |