Add an ACME delegation record to the s2i2s.cloud zone.

s2i2s/project-setup/README.md

@@ -75,6 +75,17 @@ Notes:
 - A CNAME cannot coexist with other records for the same name, so a hostname published this way
   cannot also carry its own A record.
 
+#### ACME DNS-01 challenge
+
+| Record | Type | Points to |
+| --- | --- | --- |
+| `_acme-challenge.s2i2s.cloud.isti.cnr.it.` | CNAME | `_acme-challenge.isti.cnr.it.` |
+
+Created by `openstack_dns_recordset_v2.acme_challenge_recordset` in `acme-challenge.tf` and exported
+as the `acme_challenge_hostname` output. Let's Encrypt follows the CNAME when validating DNS-01, so
+the `_acme-challenge` TXT records are published once in the `isti.cnr.it` zone instead of requiring
+write access to this zone from every client.
+
 #### Consequences of the OVN provider
 
 The OVN driver is lighter than amphora (no amphora VMs, uses the main subnet directly), but it

s2i2s/project-setup/outputs.tf

@@ -105,6 +105,12 @@ output "main_loadbalancer_hostname" {
   value       = openstack_dns_recordset_v2.main_lb_dns_recordset.name
 }
 
+# ACME DNS-01 challenge delegation
+output "acme_challenge_hostname" {
+  description = "CNAME that delegates the DNS-01 challenge to the isti.cnr.it zone"
+  value       = openstack_dns_recordset_v2.acme_challenge_recordset.name
+}
+
 # Re-export common variables for dependent modules
 output "dns_zone" {
   value = local.dns_zone