[jaspermayone]

Add a CAA record set at the apex of patchworklabs.org. Only the CAs that issue certificates for the zone can then issue them.

Tag	Value	Used by
issue	letsencrypt.org	Vercel (www, weave-kyc-proposal), the thimble VPN (vpn), Traefik on alastor
issue	pki.goog	Cloudflare Universal SSL
issue	ssl.com	Cloudflare Universal SSL
issue	sectigo.com	Cloudflare backup certificates
iodef	mailto:security@patchworklabs.org	CA reports for refused requests

flowchart LR
  CAA["CAA at patchworklabs.org"] --> LE[letsencrypt.org]
  CAA --> CF["pki.goog, ssl.com, sectigo.com"]
  LE --> V["Vercel: www, weave-kyc-proposal"]
  LE --> T["Traefik on alastor (DNS-01, no caServer)"]
  LE --> VPN["thimble VPN: vpn"]
  CF --> P["Cloudflare proxied names"]

Loading

Checks

• Traefik on alastor: the only resolver is certificatesResolvers.cloudflare.acme in jaspermayone/infra modules/traefik/default.nix. It sets no caServer, so it uses Let's Encrypt.
• The thimble VPN uses the Let's Encrypt ACME directory (patchworklabsorg/infra ansible/templates/vyos/thimble.conf.j2).
• There is no issuewild record, so the issue list also controls wildcard certificates. This is necessary for the Cloudflare *.patchworklabs.org certificate.
• The comment is above the "" key, so tools/merge_live.py keeps it after a nightly sync.
• ./bin/validate passes. The tool tests pass.

If a new service gets certificates from a different CA, add that CA here first. If the Cloudflare plan changes to Advanced Certificate Manager with DigiCert, add digicert.com.

[github-actions]

octoDNS plan

patchworklabs.org.

cloudflare

Operation	Name	Type	TTL	Value	Source
Create		CAA	3600	0 iodef "mailto:security@patchworklabs.org"; 0 issue "letsencrypt.org"; 0 issue "pki.goog"; 0 issue "sectigo.com"; 0 issue "ssl.com"	config
Update	octodns-meta	TXT	120	octodns-version=1.22.0; provider=cloudflare; time=2026-10-21T17:59:18.065564+00:00
			60	octodns-version=1.22.0; provider=cloudflare; time=2026-10-23T14:56:12.789589+00:00

Summary: Creates=1, Updates=1, Deletes=0, Existing=28, Meta=False

---

Planned against main with a read-only Cloudflare token. Only the zone files at the repository root are included. Changes to config/, bin/ or .github/ are not in this plan, so review those by hand.