---
id: w1/m11/t003
title: Domain verification status from App status / cert-manager Secret state
worker: worker1
status: done
estimate: 25m
depends_on: [w1/m11/t001]
---

## Objective

Each listed domain carries a truthful status: whether TLS is issued (cert-manager `<app>-tls` / `<app>-tls-<host>` Secret exists and is ready) and whether the host is in the converged Ingress — surfaced in whatever field Render's domain object uses (`verificationStatus`-adjacent; map honestly, omit what bex can't know).

## Context

- TLS secret naming: `tlsSecretName` in `lego/operator/internal/controller/app_controller.go` (first host keeps `<app>-tls`, extras get `<app>-tls-<host>`).
- bex-api has RBAC for CNPG connection Secrets already; domain cert Secrets may need a read rule in `lego/operator/config/api/rbac.yaml` (metadata-only read is enough — never surface the key material).

## Steps

1. Status resolver: host → expected secret name → exists/ready → status enum.
2. Wire into the t001 list shape; RBAC addition if needed (least privilege: `get` on secrets by name-pattern isn't expressible — scope by namespace + document).
3. docs/ADR005-custom-domain.md gains a "status" paragraph.

## Files

- `lego/backend/internal/apps/` (status resolver)
- `lego/operator/config/api/rbac.yaml` (if needed)
- `docs/ADR005-custom-domain.md`

## Acceptance criteria

- [ ] A freshly added domain reports unverified/pending; once cert-manager issues, the list flips to verified/ready without restarts.
- [ ] No secret key material crosses the API.

## Out of scope

- ACME troubleshooting surfaces; DNS record instructions.
