apiVersion: catalyst.openova.io/v1alpha1
kind: Blueprint
metadata:
  name: bp-cert-manager-powerdns-webhook
  labels:
    catalyst.openova.io/section: pts-3-3-security-and-policy
spec:
  version: 1.0.0
  card:
    title: cert-manager-powerdns-webhook
    summary: |
      cert-manager DNS-01 external webhook for PowerDNS. Lets the
      letsencrypt-dns01-prod-powerdns ClusterIssuer (shipped by this
      blueprint) issue wildcard TLS certificates (e.g. *.<sovereign>)
      by writing ACME challenge TXT records to contabo's central
      PowerDNS at https://pdns.openova.io (authoritative for omani.works
      because Dynadot delegates the zone to ns1/2/3.openova.io). Caught
      live on otech43–46. Closes openova#373; supersedes
      bp-cert-manager-dynadot-webhook for omani.works Sovereigns.
  visibility: unlisted              # mandatory infra, auto-installed by bootstrap kit
  manifests:
    chart: ./chart
  depends:
    # bp-cert-manager registers the cert-manager.io CRDs and deploys the
    # controllers; this webhook is meaningless without them. Per the
    # waterfall locked in by docs/INVIOLABLE-PRINCIPLES.md (intra-chart
    # CRD ordering) this chart MUST be installed AFTER bp-cert-manager
    # is Ready — Flux dependsOn enforces that at the HelmRelease level.
    - blueprint: bp-cert-manager
    # NOTE: bp-powerdns dependency intentionally REMOVED. The webhook
    # calls contabo's central PowerDNS (https://pdns.openova.io) — an
    # out-of-cluster endpoint — not the Sovereign's local PowerDNS. The
    # Sovereign's bp-powerdns slot is still installed (it backs the
    # Sovereign's own subzone for app-level records via bp-external-dns)
    # but it is NOT in the cert-issuance path.
  outputs:
    # Tells dependents (the per-Sovereign Gateway's wildcard Certificate
    # in clusters/_template/sovereign-tls/cilium-gateway-cert.yaml, etc.)
    # which solverName the ClusterIssuer's solvers[].dns01.webhook block
    # must reference. Defaults are baked into the chart values but
    # exposing them here keeps the blueprint DAG's contract honest.
    solverName: powerdns
    groupName: acme.powerdns.openova.io
    issuerName: letsencrypt-dns01-prod-powerdns
