dtoro
9016c3a43b
The cert-expiry builder and checkCertExpiry probe are correct, but the scheduler container can't reach *.hubris.network:443 — its DNS forwards to the host resolver, which doesn't know the split-horizon zone, and overriding the container DNS would break docker service-name resolution. Seeding the 20 cert entities now produced 20 false-down certificates. Keep the builder (committed), drop the entities + edges until the scheduler can reach Caddy (extra_hosts mapping, or a SNI-dial enhancement) — then re-add them.