From c741a9df3e684e9024ae3e0bb7264e06119c5a98 Mon Sep 17 00:00:00 2001
From: Kevin Midboe <kevin.midboe@gmail.com>
Date: Fri, 7 Aug 2026 21:55:29 +0200
Subject: [PATCH] configurable staging letsencrypt api

---
 roles/traefik/defaults/main.yml                  | 1 +
 roles/traefik/templates/dynamic-analytics.yml.j2 | 4 ++++
 roles/traefik/templates/dynamic-hosts.yml.j2     | 4 ++++
 roles/traefik/templates/traefik.yml.j2           | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/roles/traefik/defaults/main.yml b/roles/traefik/defaults/main.yml
index 2eb03a1..fff0b66 100644
--- a/roles/traefik/defaults/main.yml
+++ b/roles/traefik/defaults/main.yml
@@ -5,6 +5,7 @@ traefik_websecure_port: 443
 traefik_dashboard_port: 8080
 traefik_metrics_port: 8100
 traefik_dashboard_insecure: true   # ufw should only allow from tailscale or vnet
+traefik_acme_staging: "{{ lookup('env', 'TRAEFIK_ACME_STAGING') | default('false', true) }}"
 
 domain: "{{ lookup('env', 'DOMAIN') | default('', true) }}"
 # Single source of truth for static routing. Expected to be overridden
diff --git a/roles/traefik/templates/dynamic-analytics.yml.j2 b/roles/traefik/templates/dynamic-analytics.yml.j2
index df83184..42ce8fc 100644
--- a/roles/traefik/templates/dynamic-analytics.yml.j2
+++ b/roles/traefik/templates/dynamic-analytics.yml.j2
@@ -9,6 +9,10 @@ http:
       service: analytics-svc
       tls:
         certResolver: letsencrypt
+        domains:
+          - main: "analytics.{{ env_vars.DOMAIN }}"
+            sans:
+              - "blog.{{ env_vars.DOMAIN }}"
 
   services:
     analytics-svc:
diff --git a/roles/traefik/templates/dynamic-hosts.yml.j2 b/roles/traefik/templates/dynamic-hosts.yml.j2
index 4cb6735..5844d6f 100644
--- a/roles/traefik/templates/dynamic-hosts.yml.j2
+++ b/roles/traefik/templates/dynamic-hosts.yml.j2
@@ -9,6 +9,10 @@ http:
         - websecure
       tls:
         certResolver: letsencrypt
+        domains:
+          - main: "app.{{ env_vars.DOMAIN }}"
+            sans:
+              - "blog.{{ env_vars.DOMAIN }}"
 
   services:
     retailor-web-svc:
diff --git a/roles/traefik/templates/traefik.yml.j2 b/roles/traefik/templates/traefik.yml.j2
index e0d1ebf..c2556ec 100644
--- a/roles/traefik/templates/traefik.yml.j2
+++ b/roles/traefik/templates/traefik.yml.j2
@@ -27,6 +27,9 @@ certificatesResolvers:
     acme:
       email: "{{ traefik_acme_email }}"
       storage: /etc/traefik/acme.json
+{% if traefik_acme_staging | bool %}
+      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
+{% endif %}
       httpChallenge:
         entryPoint: web