cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard (#417)

why: cheeztv.unkin.net needs a publicly-trusted cert; DNS-01 via the delegated acme.unkin.net zone is now working (staging wildcard verified end-to-end in ~70s). A single centrally-managed wildcard avoids per-host CNAMEs and LE duplicate-order rate limits.

- add Certificate wildcard-unkin-net (cert-manager ns, ClusterIssuer letsencrypt prod, secret wildcard-unkin-net-tls) with emberstack reflector secretTemplate annotations
- reflect the secret into the cheeztv namespace (append future consumers to the two reflector namespace lists)
- point the public cheeztv gateway listener at wildcard-unkin-net-tls and drop its vault-issuer annotations (cheeztv-internal stays on vault-issuer)

Reviewed-on: #417
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #417.

This commit is contained in:

Unkin Agent

2026-08-25 20:58:02 +10:00

committed by

BenVincent

parent 1ecba543aa

commit d42d013541

3 changed files with 34 additions and 6 deletions

									
										apps/base/cert-manager/kustomization.yaml
									
		+1
		
												View File
												
				@@ -11,3 +11,4 @@ resources:

				  - vmservicescrape.yaml

				  - clusterissuer_letsencrypt.yaml

				  - clusterissuer_letsencrypt-staging.yaml

				  - certificate_wildcard-unkin-net.yaml