Name the smarthost mail-in.main.unkin.net and serve the *.main.unkin.net wildcard

apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml

@@ -1,6 +1,6 @@
 ---
 # Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack,
-# jellyfin, stalwart webadmin/autoconfig). DNS-01 needs the delegated
+# jellyfin, stalwart webadmin/autoconfig) and the mail smarthost. DNS-01 needs the delegated
 # _acme-challenge.main.unkin.net CNAME in the public unkin.net zone.
 # _acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net.
 apiVersion: cert-manager.io/v1
@@ -13,9 +13,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy,mail"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy,mail"
   privateKey:
     size: 4096
   dnsNames:

apps/base/mail/smarthost-statefulset.yaml

@@ -105,7 +105,7 @@ spec:
             name: smarthost-config
         - name: tls
           secret:
-            secretName: wildcard-unkin-net-tls
+            secretName: wildcard-main-unkin-net-tls
   volumeClaimTemplates:
     - metadata:
         name: spool

apps/base/mail/smarthost/main.cf

@@ -1,5 +1,5 @@
 compatibility_level = 3.5
-myhostname = smarthost.unkin.net
+myhostname = mail-in.main.unkin.net
 myorigin = unkin.net
 mydestination =
 alias_maps =