feat(tls): internal CA wildcard for *.internal routes

Selfsigned root (10y) + internal-ca issuer; per-namespace
internal-wildcard-tls certs referenced by all -local routers.
Root public cert committed for client trust stores.

nextcloud/k8s/routing/certificates.yaml

@@ -10,3 +10,19 @@ spec:
   issuerRef:
     name: letsencrypt-prod
     kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-wildcard-tls
+  namespace: nextcloud
+spec:
+  secretName: internal-wildcard-tls
+  dnsNames:
+    - "*.workstation.internal"
+    - "*.gigaforust.internal"
+    - workstation.internal
+    - gigaforust.internal
+  issuerRef:
+    name: internal-ca
+    kind: ClusterIssuer

nextcloud/k8s/routing/ingress.yaml

@@ -38,26 +38,29 @@ spec:
       services:
         - name: nextcloud-apache
           port: 11000
-# ---
-# Nextcloud AIO
-# apiVersion: traefik.io/v1alpha1
-# kind: IngressRoute
-# metadata:
-#   name: naio-prod
-#   namespace: nextcloud
-# spec:
-#   entryPoints:
-# - websecure
-# routes:
-#   - match: Host(`naio.forust.xyz`)
-#     kind: Rule
-#     services:
-#       - name: nextcloud-aio
-#         port: 8888
-#         scheme: https
-#         serversTransport: insecure-transport
-# tls:
-#   certResolver: letsencrypt
+  # ---
+  # Nextcloud AIO
+  # apiVersion: traefik.io/v1alpha1
+  # kind: IngressRoute
+  # metadata:
+  #   name: naio-prod
+  #   namespace: nextcloud
+  # spec:
+  #   entryPoints:
+  # - websecure
+  # routes:
+  #   - match: Host(`naio.forust.xyz`)
+  #     kind: Rule
+  #     services:
+  #       - name: nextcloud-aio
+  #         port: 8888
+  #         scheme: https
+  #         serversTransport: insecure-transport
+  # tls:
+  #   certResolver: letsencrypt
+  tls:
+    secretName: internal-wildcard-tls
+
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -75,3 +78,5 @@ spec:
           port: 8888
           scheme: https
           serversTransport: insecure-transport
+  tls:
+    secretName: internal-wildcard-tls