diff --git a/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml
new file mode 100644
index 0000000..8eff22e
--- /dev/null
+++ b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml
@@ -0,0 +1,26 @@
+---
+# Let's Encrypt *.ceph.unkin.net wildcard for the haproxy edge (ceph dashboard).
+# DNS-01 needs the delegated _acme-challenge.ceph.unkin.net CNAME in the public
+# unkin.net zone.
+# _acme-challenge.ceph.unkin.net. CNAME _acme-challenge.ceph.acme.unkin.net.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-ceph-unkin-net
+  namespace: cert-manager
+spec:
+  secretName: wildcard-ceph-unkin-net-tls
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy"
+  privateKey:
+    size: 4096
+  dnsNames:
+    - "*.ceph.unkin.net"
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+    group: cert-manager.io
diff --git a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
new file mode 100644
index 0000000..bc34a2b
--- /dev/null
+++ b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
@@ -0,0 +1,26 @@
+---
+# Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack,
+# jellyfin, stalwart webadmin/autoconfig). DNS-01 needs the delegated
+# _acme-challenge.main.unkin.net CNAME in the public unkin.net zone.
+# _acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-main-unkin-net
+  namespace: cert-manager
+spec:
+  secretName: wildcard-main-unkin-net-tls
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy"
+  privateKey:
+    size: 4096
+  dnsNames:
+    - "*.main.unkin.net"
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+    group: cert-manager.io
diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
index d3b971c..7873433 100644
--- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
+++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy"
   privateKey:
     size: 4096
   dnsNames:
diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml
index a102d8c..592a976 100644
--- a/apps/base/cert-manager/kustomization.yaml
+++ b/apps/base/cert-manager/kustomization.yaml
@@ -12,3 +12,5 @@ resources:
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml
   - certificate_wildcard-unkin-net.yaml
+  - certificate_wildcard-main-unkin-net.yaml
+  - certificate_wildcard-ceph-unkin-net.yaml