- RegisteredService: removed name, added subdomains bool
- CertEntry: removed service field (domain is the key)
- Ingress page: domain as primary label, subdomains badge
- Certificates page: source shown under domain
- All type-check passes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove automatic wildcard cert assumption. Each service gets its own
cert by default. Wildcards are user-initiated via the Certificates page.
Backend:
- HAProxy L7 frontend uses cert directory (/etc/haproxy/certs/)
instead of single wildcard file — loads all PEMs, serves by SNI
- Cert status API shows every registered service individually with
coveredBy field when a wildcard cert covers the domain
- Reconciliation filters L7 routes to services that have a cert
- No auto-provisioning in reconciliation (just warnings)
Frontend:
- Certificates page shows per-service cert status
- "Provision" button for individual certs
- "Add Wildcard" form for opt-in wildcard provisioning
- Fixed CloudflareComponent type errors from cert API changes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New dedicated Certificates page in Wild Central UI showing:
- All tracked certs (central, wildcard, per-service)
- Status (valid with days remaining, or missing)
- Per-domain Provision button
- Renew All button
Cert provisioning is now user-initiated only — reconciliation logs
warnings about missing certs but does NOT auto-provision. This
prevents unexpected wildcard cert requests on startup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
