rcourtman 4885c378aa Keep the operator .env out of the Traefik container and unhardcode the DNS-01 provider ... Traefik took the whole operator .env via env_file, so the internet-facing container's environment carried CP_ADMIN_KEY and the entitlement signing private key, neither of which it needs. It now receives only ACME/DNS material: the CF token by explicit passthrough plus an optional dns-credentials.env that setup.sh creates 0600. The same wiring removes the silent Cloudflare-only narrowing: the resolver provider is now ACME_DNS_PROVIDER (default cloudflare) via Traefik's env override, the CF token is required only for the default provider, and any other Traefik dnsChallenge provider supplies its credential variables through dns-credentials.env. Pinned by TestProviderMSPTraefikEnvIsMinimalAndDNSProviderOverridable; contract delta in deployment-installability.		2026-08-07 10:47:13 +01:00
..
.env.example	Keep the operator .env out of the Traefik container and unhardcode the DNS-01 provider	2026-08-07 10:47:13 +01:00
docker-compose.yml	Keep the operator .env out of the Traefik container and unhardcode the DNS-01 provider	2026-08-07 10:47:13 +01:00
Dockerfile.control-plane	Modernize Unified Agent lifecycle and platform support	2026-07-09 23:20:35 +01:00
run-install-proof.sh	Harden provider-hosted MSP isolation	2026-06-02 21:10:13 +01:00
setup.sh	Keep the operator .env out of the Traefik container and unhardcode the DNS-01 provider	2026-08-07 10:47:13 +01:00
traefik-dynamic.yml	Harden provider-hosted MSP isolation	2026-06-02 21:10:13 +01:00
traefik.yml	Add provider-hosted MSP install path	2026-06-02 12:11:35 +01:00
upgrade.sh	Harden provider-hosted MSP isolation	2026-06-02 21:10:13 +01:00