# k8s/ingress/wildcard-cert.yaml
# Single wildcard TLS certificate for all *.riotpiao.homelab.com services.
# Lives in the ingress-nginx namespace and is set as nginx's default-ssl-certificate,
# so every ingress host gets it automatically — no per-service TLS blocks needed.
#
# Renewal: cert-manager auto-renews 30 days before expiry (renewBefore: 720h).
# nginx detects the secret update via its K8s watch and hot-reloads — no pod restart.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: homelab-tls
  namespace: ingress-nginx
spec:
  secretName: homelab-tls
  dnsNames:
    - "*.riotpiao.homelab.com"
    - "riotpiao.homelab.com"
  issuerRef:
    name: homelab-ca
    kind: ClusterIssuer
  duration: 8760h      # 1 year
  renewBefore: 720h    # renew 30 days before expiry