# Wildcard TLS cert for the fxhnt.ai fund ingress on bizworx.
# Issued by the existing bizworx letsencrypt-prod ClusterIssuer (Scaleway DNS-01 webhook), which already
# issues real LE certs across ~10 namespaces. The fxhnt-ingress proxy (P2) terminates *.fxhnt.ai with this.
# DNS-01 provisions a TXT on the Scaleway fxhnt.ai zone we control -> no HTTP reachability needed to issue.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: fxhnt-wildcard
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  commonName: fxhnt.ai
  dnsNames:
    - fxhnt.ai
    - "*.fxhnt.ai"
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-prod
  secretName: fxhnt-wildcard-tls
  privateKey:
    rotationPolicy: Always
