From 7cdbd128352cd566fd7addcf78e097d37c394487 Mon Sep 17 00:00:00 2001
From: kurogeek <kurogeek@lmvhaus.com>
Date: Mon, 26 Oct 2026 10:21:34 +0000
Subject: [PATCH] inventory/data-mesher: sign node identity certs for 10 years

All data-mesher-node-identity certs were signed on 2026-07-22 with the
default 90-day validity and expired on 2026-10-20, taking the whole mesh
down ("identity certificate not signed by network certificate authority"
is actually an expiry failure). Nothing rotates them automatically.

Requires `clan vars generate --generator data-mesher-node-identity
--regenerate` and a redeploy to take effect.
---
 inventories/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inventories/default.nix b/inventories/default.nix
index 9187214e..6253924b 100644
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -117,6 +117,9 @@
           roles.bootstrap.tags = [ "dm-bootstrapper" ];
           roles.default.tags = [ "all" ];
           roles.default.settings.interfaces = [ "ygg" ];
+          # default 2160h (90d) expired cluster-wide on 2026-10-20; node certs
+          # are only re-signed when `clan vars generate --regenerate` is run.
+          roles.default.settings.certificateValidity = "87600h";
         };
 
         auto-pull-update = {