enable-https

Put a real Let's Encrypt wildcard certificate on the network's bastion and make its nginx terminate TLS. The DNS-01 challenge is provider-pluggable — the deployment's public DNS can live wherever you keep it (Route 53, Hetzner DNS, Cloudflare).

Syntax

rumi cloud hetzner enable-https \
  --api-key <token> \
  --network <network> \
  --key-pair <keypair> \
  --domain <domain> \
  --dns-provider <route53|hetzner|cloudflare> \
  --dns-credentials <credential> \
  [options]

Options

Option	Short	Description	Default
--api-key	-k	The Hetzner Cloud project API token (or set HCLOUD_TOKEN)	Required
--region	-r	The Hetzner location the network is in	fsn1
--network	-n	Name of the network whose bastion to secure	Required
--key-pair	-K	The SSH key pair to reach the bastion	Required
--domain	-d	The base domain to secure; the wildcard cert covers <domain> and *.<domain>	Required
--dns-provider	-P	The DNS provider hosting the domain: route53, hetzner, or cloudflare	Required
--dns-credentials	-C	The provider credential for the DNS-01 challenge (format per provider, below)	Required
--email	-m	Let's Encrypt account email for expiry notices	none
--force	-f	Re-point a bastion already secured for a DIFFERENT domain	false

--dns-credentials format by provider

Provider	certbot plugin	--dns-credentials value
route53	certbot-dns-route53	<accessKeyId>:<secretKey>[:region] (default region us-east-1)
hetzner	certbot-dns-hetzner	the Hetzner Cloud API token
cloudflare	certbot-dns-cloudflare	the Cloudflare API token

Example

# DNS for the domain lives in AWS Route 53
rumi cloud hetzner enable-https \
  --api-key $HCLOUD_TOKEN \
  --network my-cloud \
  --key-pair rumi \
  --domain rumi-https.n5corp.ai \
  --dns-provider route53 \
  --dns-credentials "AKIA...:wJalr...:us-east-1" \
  --email [e-mail]

Notes

• The bastion runs certbot certonly --<provider> for a wildcard DNS-01 cert; renewal is hands-free (a baked certbot-renew timer replays the challenge with the stored credential). The credential is written root-only on the bastion.

• Rumi does not manage public DNS. Pointing the public name at the bastion — e.g. *.<domain> or <service>.<domain> → the bastion's public IP — is your job, in whatever DNS hosts the domain. enable-https only proves control of the domain (the DNS-01 challenge) to issue the cert.

• Use a tightly-scoped credential: for Route 53, an IAM key limited to route53:ChangeResourceRecordSets/ListHostedZones/GetChange on that zone. It lives on the bastion for issuance and renewal.

• Run it after launch-bastion and BEFORE adding service proxies, so each proxy is created as a TLS block.

• A bastion secures exactly one domain. Re-running with the same domain is an idempotent renew; switching domains needs --force.

• Adding another DNS provider later = a new certbot-dns-<provider> plugin in the bastion bake + a case in enable_https.sh.

See Also

• launch-bastion

• add-proxy