Domains, TLS & CDN

Fleet view of certificates, DNS zones, domain verification, edge workers, the Caddy reverse proxy for CMS traffic (*.web.petanque.life + custom domains) and Loopia auto-provisioning of platform subdomains. Tenant admins point their own domain at CNAME target proxy.web.petanque.life from Admin → Tema & CMS.

214

certificates in fleet

renewal failing

CMS sites on proxy

99.99%

proxy uptime 30 d

ACME / Let's Encrypt certificate fleet

Domain	Kind	Issuer / challenge	Expires	Renewal	Status
skanebf.se	custom domain (CMS)	Let's Encrypt · HTTP-01 (Caddy on-demand)	2026-08-21	auto (30 d before)	active
*.web.petanque.life	wildcard	Let's Encrypt · DNS-01	2026-09-02	auto	active
nordvikbk.web.petanque.life	platform subdomain	covered by wildcard	—	—	active
boule-beziers.fr	custom domain (CMS)	Let's Encrypt · HTTP-01	2026-07-09	auto — renewal failing	renewal_failed

CMS traffic terminates TLS on the Caddy proxy (on-demand HTTP-01, cert cache in the caddy_data volume). Issuance is gated by GET /public/domains/cert-allowed?domain=… — 200 only when the hostname matches an active CmsSite subdomain/domain or a verified custom domain (abuse guard).

State — renewal failing

⚠

boule-beziers.fr — HTTP-01 challenge unreachable (expires in 6 days)

The federation's A record no longer points at the proxy. Contact tenant or re-run verification; auto-renew retries every 6 h.

Cloudflare DNS zones & records

Zone	Name	Type	Content	Proxied
petanque.life	api	A	20.112.84.10	yes
petanque.life	proxy.web	A	20.238.51.13 (vm-petanque-proxy)	no
web.petanque.life	nordvikbk	A	20.238.51.13	no
petanque.life	@	MX	10 mail.protection.example	—
petanque.life	_dmarc	TXT	v=DMARC1; p=quarantine	—

Zone CRUD + A/AAAA/CNAME/MX/TXT record management per tenant zone.

Add DNS record

Zone * Type * Name * e.g. newclub → newclub.web.petanque.life Content * TTL Proxied through Cloudflare Off for proxy-terminated CMS hosts

Domain verification queue (TXT / CNAME methods · wildcard certificates)

Domain	Tenant	Method	Token	Status
skanebf.se	Svenska Bouleförbundet	TXT	pl-verify=8f2a…	verified
boule-beziers.fr	FFPJP (FR)	CNAME → proxy.web.petanque.life	—	verified
bergenboule.no	Norges Forbund	TXT	pl-verify=1c9d…	pending

Verification gates certificate issuance for custom domains. Wildcard certificates (*.web.petanque.life) are managed separately via DNS-01.

Caddy reverse proxy — vm-petanque-proxy

up Azure VM B1s · static IP 20.238.51.13 Caddy 2.x in Docker · cert volume caddy_data

On-demand TLS via Let's Encrypt HTTP-01 for unlimited CMS sites in front of swa-petanque-web (header_up Host preserved). Stable CNAME target for federations' own domains: proxy.web.petanque.life. Replaces Cloudflare for SaaS (kept dormant as fallback).

Cloudflare Workers (edge computing)

Worker	Routes	Version	Status
edge-redirects	petanque.life/r/*	v14	deployed
img-resize	cdn.petanque.life/i/*	v8	deployed
ab-router (paused)	web.petanque.life/*	v3	paused

Deployment management per worker: deploy · rollback · pause.

Loopia DNS auto-provisioning — platform subdomains (per CmsSite lifecycle)

Site slug	Record	dns_provisioning_status	Provisioned at	Error
nordvikbk	nordvikbk.web.petanque.life → 20.238.51.13	active	2026-06-12 10:03	—	—
sjostadpk	sjostadpk.web.petanque.life → 20.238.51.13	active	2026-06-20 14:41	—	—
granholmpk	granholmpk.web.petanque.life	failed	—	Loopia XML-RPC timeout — retry with repair-dns
proxy	reserved slug	disabled	—	blocked (reserved: proxy, _acme-challenge, test)	—

Create/rename/delete of a CmsSite provisions the A record via Loopia XML-RPC. Transient API failures never roll back site creation — the site lands as failed and repair-dns retries idempotently. Reserved slugs are blocked: proxy, _acme-challenge, test.

State — no pending verifications

✓

Verification queue is empty

New custom domains appear here until their TXT/CNAME proof resolves.

State — loading zone list