Agent-spawned compute

An address is not a URL

Let's Encrypt issues certificates for IP addresses, so a machine the internet can reach can serve HTTPS with no name at all. Those last six days by rule, because an address is transient, and they validate over http-01 or tls-alpn-01 only. A machine behind NAT, on a private address, or not answering on 443 cannot have one.

The address is also the thing most likely to change. Anything that writes an address into a URL has to reissue the URL when the machine moves, and every client already holding the old one is looking at a dead name.

Three calls, in this order

POST the address the moment the machine has one. IPv4 or IPv6, public or private. What comes back is a hostname already resolving from our nameservers; omit subdomain and we mint an opaque label, which is usually what an agent wants.

Ask that hostname for its DNS-01 credential and hand it to the ACME client on the box. It is scoped to the one hostname, in the acme-dns format certbot, Caddy, Traefik, lego and cert-manager already speak, and we publish the challenge record, so the CA never has to reach the machine. Caddy picks it up and HTTPS is live about a minute later. If you would rather not run an ACME client at all, ask for a managed certificate and it comes back from the same API.

Then hand out the URL. It is a name on a domain nobody else is on, with a publicly trusted certificate, and nothing had to be bought for it to exist.

When the machine is replaced

PUT the new address onto the same hostname. The name does not change, so everything already pointing at it keeps working, and the certificate on the new machine is for the same name as the one on the old machine. This is the difference between a name and an address written out in the shape of a name: one can be moved and the other can only be replaced.

When the task is over

Release the hostname. It stops resolving, the label goes back, and a managed certificate issued for it is revoked rather than left to expire on its own. An agent that mints without releasing spends its plan on names nothing is using.

Doing this for customers

If the machines belong to your customers rather than to you, the question becomes which customer sits on which domain, and that is what agent platforms covers.