SmooaiNextEdge: auto-validate us-east-1 viewer cert via DNS adapter (0.1.4)#3
Merged
Conversation
… via the DNS adapter (0.1.4) Dogfooding Stage C surfaced a gap: the construct created the ACM viewer cert (validationMethod: DNS) but never published the validation records or gated on an aws.acm.CertificateValidation. On a Cloudflare-DNS app the cert stays PENDING_VALIDATION and CloudFront refuses to attach it — the deploy fails. Mirror SST's DnsValidatedCertificate: when the DNS adapter exposes createRecord, publish the ACM DNS-validation CNAMEs (de-duped) + a CAA(amazonaws.com) for non-Route53 zones, then gate the distribution's viewerCertificate on a CertificateValidation (us-east-1 provider). Validation CNAMEs are never proxied (SST's cloudflare adapter only proxies alias records), as ACM requires. No createRecord on the adapter → unchanged behavior (raw PENDING arn, manual validation). Extend DnsAdapter with optional provider/createRecord/createCaa. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Dogfooding Stage C (SMOODEV-1791) on smooai's apps/web surfaced a real gap in
SmooaiNextEdge: it creates the ACM viewer cert withvalidationMethod: 'DNS'but never publishes the validation records and never gates onaws.acm.CertificateValidation. On a Cloudflare-DNS app the cert sits inPENDING_VALIDATION, so when theCloudFront Distributiontries to attach it the deploy fails ("certificate doesn't exist, isn't valid…").Fix
Mirror SST's own
DnsValidatedCertificate:DnsAdapterwith optionalprovider/createRecord/createCaa(the surfacesst.cloudflare.dns()/sst.aws.dns()already expose).createRecord: publish the ACM DNS-validation CNAMEs (de-duped across domain + SANs), add aCAA 0 issue "amazonaws.com"for non-Route53 zones, and gateviewerCertificateon aCertificateValidation(us-east-1 provider,dependsOnthe records).createRecord(or nodns) → unchanged behavior: raw (PENDING) arn, manual/out-of-band validation.Bumps
@smooai/deploy→ 0.1.4.Test
pnpm sst install && pnpm typecheckgreen against the SST platform ambient types (the PR-checksconstructsgate). Behavior validated end-to-end by Stage C Phase 1 (smooaiweb-next.smoo.ai).🤖 Generated with Claude Code