Implement EnsureCNAME function and tests for wildcard CNAME creation in Cloudflare

internal/reconcile/reconciler.go

@@ -15,6 +15,7 @@ import (
 	"github.com/wild-cloud/wild-central/internal/authelia"
 	"github.com/wild-cloud/wild-central/internal/certbot"
 	"github.com/wild-cloud/wild-central/internal/config"
+	"github.com/wild-cloud/wild-central/internal/ddns"
 	"github.com/wild-cloud/wild-central/internal/dnsmasq"
 	"github.com/wild-cloud/wild-central/internal/domains"
 	"github.com/wild-cloud/wild-central/internal/haproxy"
@@ -205,6 +206,7 @@ func (r *Reconciler) Reconcile() {
 	}
 
 	r.DDNS.Trigger()
+	r.ensureCloudflareCNAMEs(doms)
 
 	r.health.UpdatedAt = time.Now()
 
@@ -503,6 +505,31 @@ func (r *Reconciler) ensureTLSCerts(globalCfg *config.State, doms []domains.Doma
 	return stillMissing
 }
 
+// ensureCloudflareCNAMEs creates wildcard CNAME records in Cloudflare for
+// public domains with subdomains enabled (e.g., *.cloud.payne.io → cloud.payne.io).
+// This makes subdomains resolvable on the public internet without individual
+// DNS records per app.
+func (r *Reconciler) ensureCloudflareCNAMEs(doms []domains.Domain) {
+	cfToken := ""
+	if r.GetCloudflareToken != nil {
+		cfToken = r.GetCloudflareToken()
+	}
+	if cfToken == "" {
+		return
+	}
+
+	for _, dom := range doms {
+		if !dom.Public || !dom.Subdomains || dom.DomainName == "" {
+			continue
+		}
+		cname := "*." + dom.DomainName
+		if err := ddns.EnsureCNAME(cfToken, cname, dom.DomainName); err != nil {
+			slog.Warn("failed to ensure wildcard CNAME", "component", "reconcile",
+				"cname", cname, "target", dom.DomainName, "error", err)
+		}
+	}
+}
+
 // hasCertForDomain checks if a valid (non-empty) cert exists for a domain —
 // either an individual cert (<domain>.pem) or a wildcard cert that covers it.
 func hasCertForDomain(domain string) bool {