certificate.yaml

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-test
spec:
  acme:
    email: acme@${CLUSTER_DOMAIN}
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-test
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - selector: {}
      dns01:
        webhook:
          groupName: "${CLUSTER_DOMAIN}"
          solverName: dnsmadeeasy
          config:
            apiKeyRef:
              name: dnsmadeeasy
              key: key
            apiSecretRef:
              name: dnsmadeeasy
              key: secret
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: "acme@${CLUSTER_DOMAIN}"
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - selector: {}
      dns01:
        webhook:
          groupName: "${CLUSTER_DOMAIN}"
          solverName: dnsmadeeasy
          config:
            apiKeyRef:
              name: dnsmadeeasy
              key: key
            apiSecretRef:
              name: dnsmadeeasy
              key: secret
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: acme-crt
  namespace: cert-manager
spec:
  secretName: "${CLUSTER_DOMAIN_CERT}"
  issuerRef:
    #name: letsencrypt-test
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - '${CLUSTER_DOMAIN}'
  - '*.${CLUSTER_DOMAIN}'
  - '*.home.${CLUSTER_DOMAIN}'
  - '*.pub.${CLUSTER_DOMAIN}'
  # This dummy can be changed to circumvent Letsencrypt check for duplicated certs
  # The right fix is to backup certificates correctly
  - '*.${CLUSTER_DOMAIN_DUMMY}.${CLUSTER_DOMAIN}'
  secretTemplate:
    annotations:
      replicator.v1.mittwald.de/replicate-to: "authentik,maddy"