diff options
| author | Luke Hoersten <[email protected]> | 2026-06-29 21:13:59 -0500 |
|---|---|---|
| committer | Luke Hoersten <[email protected]> | 2026-06-29 21:13:59 -0500 |
| commit | b15bc8b162e9aacd12c7882ddb3c8cc3ca82189b (patch) | |
| tree | 3f2627d34069f182a130777c97d5afbf4ca3a4df /certbot-dns-cloudflare/templates | |
| parent | ad2215ee82a87f11c23a7b50c7cc09de9bb7c802 (diff) | |
certbot: scoped CF API token; gate prosody deploy hook on RENEWED_LINEAGE
cred.conf.j2 now emits the single-line dns_cloudflare_api_token form (scoped
Cloudflare API Token) instead of the legacy account-wide email + global API key.
prosody.sh.j2 deploy hook now no-ops unless $RENEWED_LINEAGE matches the prosody
vhost, so unrelated lineage renewals (haskell.social, etracapital.com) no longer
report a spurious "Hook reported error code 1 / No certificate for host found".
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Diffstat (limited to 'certbot-dns-cloudflare/templates')
| -rw-r--r-- | certbot-dns-cloudflare/templates/cred.conf.j2 | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/certbot-dns-cloudflare/templates/cred.conf.j2 b/certbot-dns-cloudflare/templates/cred.conf.j2 index 73db188..648cfd2 100644 --- a/certbot-dns-cloudflare/templates/cred.conf.j2 +++ b/certbot-dns-cloudflare/templates/cred.conf.j2 @@ -1,2 +1,4 @@ -dns_cloudflare_email = {{certbot_dns_cloudflare_email}} -dns_cloudflare_api_key = {{certbot_dns_cloudflare_api_key}} +# Cloudflare credentials for the certbot DNS-01 challenge. +# Scoped API Token (Zone:DNS:Edit on the relevant zones) — see the +# "TLS / SSL Certificates" section of the rpi playbook README. +dns_cloudflare_api_token = {{certbot_dns_cloudflare_api_token}} |