Use wildcard cert everywhere!

cluster/apps/authentik/helm-release.yaml

@@ -58,10 +58,14 @@ spec:
         cert-manager.io/cluster-issuer: "letsencrypt-production"
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
       hosts:
-        - host: auth.${SECRET_NEW_DOMAIN}
+        - host: &host "auth.${SECRET_NEW_DOMAIN}"
           paths:
-            - path: "/"
+            - path: /
               pathType: Prefix
+      tls:
+        - hosts:
+            - *host
+          secretName: wildcard-main-tls
 
     monitoring:
       enabled: false # temporarily disable monitoring

cluster/apps/management/guacamole/helm-release.yaml

@@ -44,13 +44,16 @@ spec:
       main:
         enabled: true
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "remote.${SECRET_NEW_DOMAIN}"
+          - host: &host "remote.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/media/audiobookshelf/helm-release.yaml

@@ -33,13 +33,16 @@ spec:
       main:
         enabled: true
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "audiobooks.${SECRET_NEW_DOMAIN}"
+          - host: &host "audiobooks.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/media/jellyfin/helm-release.yaml

@@ -36,13 +36,16 @@ spec:
       main:
         enabled: true
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "watch.${SECRET_NEW_DOMAIN}"
+          - host: &host "watch.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/media/jellyseerr/helm-release.yaml

@@ -39,13 +39,16 @@ spec:
       main:
         enabled: true
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "request.${SECRET_NEW_DOMAIN}"
+          - host: &host "request.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/media/kavita/helm-release.yaml

@@ -30,13 +30,16 @@ spec:
       main:
         enabled: true
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "books.${SECRET_NEW_DOMAIN}"
+          - host: &host "books.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
     persistence:
       config:
         enabled: true

cluster/apps/media/komga/helm-release.yaml

@@ -32,13 +32,16 @@ spec:
       main:
         enabled: true
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "comics.${SECRET_NEW_DOMAIN}"
+          - host: &host "comics.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
     persistence:
       config:
         enabled: true

cluster/apps/media/plex/helm-release.yaml

@@ -47,13 +47,16 @@ spec:
       main:
         enabled: true
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-production"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure #,plex
         hosts:
-          - host: "plex.${SECRET_NEW_DOMAIN}"
+          - host: &host "plex.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/tools/hastebin/helm-release.yaml

@@ -53,10 +53,14 @@ spec:
           cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "paste.${SECRET_NEW_DOMAIN}"
+          - host: &host "paste.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     resources:
       requests:

cluster/apps/tools/transfersh/helm-release.yaml

@@ -49,10 +49,14 @@ spec:
           cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "upload.${SECRET_NEW_DOMAIN}"
+          - host: &host "upload.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     persistence:
       storage:

cluster/apps/tools/vaultwarden/helm-release.yaml

@@ -36,10 +36,14 @@ spec:
           cert-manager.io/cluster-issuer: "letsencrypt-production"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - host: "bitwarden.${SECRET_NEW_DOMAIN}"
+          - host: &host "bitwarden.${SECRET_NEW_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
 
     persistence:
       data:

cluster/core/cert-manager/wildcard-cert.yaml

@@ -8,13 +8,13 @@ spec:
 
   secretTemplate:
     annotations:
-      replicator.v1.mittwald.de/replicate-to: "traefik,download"
+      replicator.v1.mittwald.de/replicate-to: "traefik,download,media,tools,management,authentik"
 
   duration: 2160h # 90d
   renewBefore: 360h # 15d
 
   issuerRef:
-    name: letsencrypt-staging
+    name: letsencrypt-prod
     kind: ClusterIssuer
 
   dnsNames: