Post #3233801
2026-04-27 23:28 UTC
@lispi314@udongein.xyz The ACME client literally doesn't need any permissions to modify privileged infrastructure (web content, DNS entries) to get its new/updated certificate. All it needs is its private key. It's sooooo good.
Replies (1)
-
@lispi314@udongein.xyz 2026-04-27 23:33
@dalias@hachyderm.io I had been using a VM to do the requesting + Ansible to then copy everything from it to their eventual target VMs periodically. Not particularly elegant but I found it mitigated most of the risks. This obviates the plugin code that needed. One less thing to maintain.