k.rennerandClaude Opus 4.7
6cf74eb15d
ci/woodpecker/manual/e2e-test Pipeline was successful
ci/woodpecker/manual/migrate-paperless Pipeline was successful
ci/woodpecker/manual/migrate-authentik-db Pipeline was successful
ci/woodpecker/cron/security-scan Pipeline was successful
ci/woodpecker/manual/rebuild-k8s Pipeline was successful
- Flip all ingress cert-manager.io/cluster-issuer annotations from letsencrypt-prod to letsencrypt-staging. Five rebuilds in a week tripped LE's per-identifier rate limit (5 certs / 168h) and left 3 hostnames with the ingress-nginx fake cert. Staging has ~30k/week, so rebuilds stop being rate-limited. ClusterIssuer definitions for both remain in post-crds; flip back per-ingress when ready for prod. - Rework e2e-test.sh TLS check to validate the cert *issuer* contains "Let's Encrypt" rather than chain-validating against the public CA bundle. Same check works for both staging and prod, and still catches the real failure mode (fake cert = cert-manager broken). - HTTP checks now use -k since staging certs aren't publicly trusted; the separate TLS check is what asserts cert-manager worked. - Chain the e2e step onto .woodpecker/rebuild-k8s.yml so every rebuild validates the resulting cluster end-to-end before reporting success. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>