* fix(bp-harbor): CNPG database must be 'registry' not 'harbor' — matches coreDatabase
Harbor upstream always connects to a database named 'registry'
(harbor.database.external.coreDatabase default). The CNPG Cluster was
initialised with database='harbor', causing:
FATAL: database "registry" does not exist (SQLSTATE 3D000)
Fix: change postgres.cluster.database default from 'harbor' → 'registry'
in values.yaml and cnpg-cluster.yaml template. Both the CNPG bootstrap
and Harbor's coreDatabase now use 'registry'.
Runtime fix on otech22: CREATE DATABASE registry OWNER harbor was run
against harbor-pg-1. harbor-core is now 1/1 Running.
Bump bp-harbor 1.2.1 → 1.2.2. Bootstrap-kit refs updated.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(tls): DNS-01 wildcard TLS chain — solverName, NodePort 30053, dynadot test fix
Five independent fixes that together complete the DNS-01 wildcard TLS chain
for per-Sovereign certificate autonomy:
1. cert-manager-powerdns-webhook solverName mismatch (root cause of #550 echo):
- values.yaml: `webhook.solverName: powerdns` → `pdns`
- The zachomedia binary's Name() returns "pdns" (hardcoded). cert-manager
calls POST /apis/<groupName>/v1alpha1/<solverName>; when solverName is
"powerdns" cert-manager gets 404 → "server could not find the resource".
2. cert-manager-dynadot-webhook solver_test.go mock format:
- writeOK() and error injection used old ResponseHeader-wrapped format
- Real api3.json returns ResponseCode/Status directly in SetDnsResponse
- This caused the image build to fail at ccc38987 so the dynadot fix
never shipped; solver tests now pass cleanly (go test ./... OK)
3. PowerDNS NodePort 30053 anycast overlay (bootstrap-kit and template):
- _template/bootstrap-kit/11-powerdns.yaml: adds anycast NodePort values
- omantel + otech bootstrap-kit: same NodePort 30053 overlay applied
- anycast-endpoint.yaml: optional nodePort field rendered in port list
4. Hetzner LB + firewall for DNS port 53 (infra/hetzner/main.tf):
- hcloud_load_balancer_service.dns: TCP:53 → NodePort 30053
- Firewall: TCP+UDP :53 from 0.0.0.0/0,::/0
5. dynadot-client JSON parsing fix (core/pkg/dynadot-client):
- AddRecord + SetFullDNS: struct no longer wraps respHeader in ResponseHeader
- client_test.go: mock responses updated to real api3.json format
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: alierenbaysal <alierenbaysal@openova.io>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
5a403e66b1