jschoubben
e1febe8e0f
The consolidation left a sparse sequence -- 1, 4, 6, 7, 9, 10, 12, 15, 16, 18, 19, 25, 34, 35, 36, 37, 40, 42, 44, 45, 48, 49, 58 -- where the gaps were only the archaeology of what used to be there. Renumbered contiguously. Renames run in ascending order, so every target number is already free and no two files ever collide. The reference rewrite is one simultaneous pass rather than a sequence of replacements. Numbers moved into slots other numbers were vacating -- the node host went 37 to 16 while the lab went 16 to 9 -- so replacing one at a time would have cascaded and silently pointed things at the wrong record. Seven plain-text references survived the merges as prose rather than links, naming records that no longer existed: the enrolment token, the link boundary, what a declaration is, reachability, the repository structure. Each mapped to the consolidated record that now holds it. Verified rather than assumed: every [ADR NNNN](path) link now has matching text and target, checked across the whole repository, and the checker passes. Frontmatter `consolidates:` lists dropped -- they named records that are gone, and each consolidated record already says in prose what it absorbed.
38 lines
1.3 KiB
Markdown
38 lines
1.3 KiB
Markdown
---
|
|
status: open
|
|
opened: 2026-08-22
|
|
located-in: []
|
|
fixed-by:
|
|
amended-design:
|
|
---
|
|
|
|
# 004 — Certificate issuance always targets the authority's production endpoint
|
|
|
|
## Symptom
|
|
|
|
The reverse proxy sets no staging endpoint for its certificate resolver. Issuance therefore
|
|
goes to the public authority's production endpoint in every case, including experiments.
|
|
|
|
## Why this matters
|
|
|
|
Production issuance is rate-limited per domain and per account. Every certificate experiment on
|
|
a real node consumes quota that is not replenished quickly, and exhausting it is not
|
|
recoverable by retrying — it removes the ability to issue a certificate anyone actually needs.
|
|
|
|
The consequence lands hardest on exactly the work most likely to iterate: standing up a new
|
|
node, changing how names resolve, or testing the lab's certificate authority split
|
|
([ADR 0009](../../02-DECISIONS/0009-the-lab.md)).
|
|
|
|
## Evidence
|
|
|
|
- The resolver configuration declares no staging endpoint.
|
|
- Observed 2026-08-22.
|
|
|
|
## Open questions
|
|
|
|
- Should the endpoint be a node property — production for nodes serving real traffic, staging
|
|
everywhere else — rather than a fixed proxy setting?
|
|
- The lab issues its own certificates and so does not consume public quota at all. Does that
|
|
make this a problem only for experiments run outside the lab, and therefore an argument for
|
|
running them inside it?
|