From 264815b2d2a928dbf85e2c1439d6e6d5868093b6 Mon Sep 17 00:00:00 2001
From: willemjan <wulsspaans@gmail.com>
Date: Fri, 6 Nov 2026 20:37:30 +0100
Subject: [PATCH] feat: move argocd/authentik to *.labzand.com with Cloudflare
 DNS-01 wildcard certs

Internal-only hostnames (argocd.labzand.com, auth.labzand.com) via AdGuard
wildcard rewrite; certs still valid via DNS-01 so no browser warnings.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 services/argocd/cert.yaml       | 13 +++++++++++++
 services/argocd/ingress.yaml    |  6 +++---
 services/authentik/cert.yaml    | 12 ++++++++----
 services/authentik/ingress.yaml |  6 +++---
 4 files changed, 27 insertions(+), 10 deletions(-)
 create mode 100644 services/argocd/cert.yaml

diff --git a/services/argocd/cert.yaml b/services/argocd/cert.yaml
new file mode 100644
index 0000000..68e527e
--- /dev/null
+++ b/services/argocd/cert.yaml
@@ -0,0 +1,13 @@
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# DNS-01 werkt ook voor hostnames die niet publiek bereikbaar zijn.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: labzand-wildcard
+  namespace: argocd
+spec:
+  secretName: labzand-wildcard-tls
+  dnsNames: ["*.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer
diff --git a/services/argocd/ingress.yaml b/services/argocd/ingress.yaml
index 11f998b..90a68d9 100644
--- a/services/argocd/ingress.yaml
+++ b/services/argocd/ingress.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: argocd
 spec:
   rules:
-  - host: argocd.zb-kw.duckdns.org
+  - host: argocd.labzand.com
     http:
       paths:
       - path: /
@@ -16,5 +16,5 @@ spec:
             port:
               number: 80        # poort 80 van de svc = HTTP-backend
   tls:
-  - hosts: [argocd.zb-kw.duckdns.org]
-    secretName: zb-kw-wildcard-tls
\ No newline at end of file
+  - hosts: [argocd.labzand.com]
+    secretName: labzand-wildcard-tls
diff --git a/services/authentik/cert.yaml b/services/authentik/cert.yaml
index c55fdeb..2e200c5 100644
--- a/services/authentik/cert.yaml
+++ b/services/authentik/cert.yaml
@@ -1,9 +1,13 @@
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# Vervangt de oude duckdns-cert (zb-kw-wildcard-tls).
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: zb-kw-wildcard
+  name: labzand-wildcard
   namespace: authentik
 spec:
-  secretName: zb-kw-wildcard-tls
-  dnsNames: ["auth.zb-kw.duckdns.org"]
-  issuerRef: {name: duckdns, kind: ClusterIssuer}
\ No newline at end of file
+  secretName: labzand-wildcard-tls
+  dnsNames: ["*.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer
diff --git a/services/authentik/ingress.yaml b/services/authentik/ingress.yaml
index 0b3c11a..9d9264a 100644
--- a/services/authentik/ingress.yaml
+++ b/services/authentik/ingress.yaml
@@ -9,7 +9,7 @@ metadata:
 spec:
   ingressClassName: traefik
   rules:
-  - host: auth.zb-kw.duckdns.org
+  - host: auth.labzand.com
     http:
       paths:
       - path: /
@@ -21,5 +21,5 @@ spec:
               number: 9000
   tls:
   - hosts:
-    - auth.zb-kw.duckdns.org
-    secretName: zb-kw-wildcard-tls
\ No newline at end of file
+    - auth.labzand.com
+    secretName: labzand-wildcard-tls