---
# Wildcard certificate `*.home.keithjackson.dev`, terminated at the shared Gateway (ADR-0006 default).
# Makes onboarding certificate-free. Issued by the env-selected ClusterIssuer (R-ENV-02).
# Phase 0 STUB — cannot issue without a cluster + Cloudflare token.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-home
  namespace: gateway
spec:
  secretName: wildcard-home-tls        # consumed by the Gateway HTTPS listener below
  dnsNames:
    - "*.${BASE_DOMAIN}"
    - "${BASE_DOMAIN}"          # apex for the C2 UI (docs/09)
  issuerRef:
    kind: ClusterIssuer
    # ${ACME_CLUSTER_ISSUER}: dev -> letsencrypt-staging, prod -> letsencrypt-prod (cluster-vars).
    name: ${ACME_CLUSTER_ISSUER}