Migrate to wildcard Let's Encrypt certificates

[Copilot]

Reduces Let's Encrypt API load from 50+ individual certificate requests to 2 wildcard certificates for *.viewpoint.house and *.glasgownet.com.

Changes

Traefik configuration (2 files)

• Added wildcard certificate routers with DNS challenge configuration
• Routers target api@internal service and define tls.domains with SANs

Service configuration (47 files)

• Removed tls.certresolver=letsencrypt from all service routers (57 instances)
• Removed explicit tls.domains[0].main declarations (42 instances)
• Retained tls=true for certificate selection

Configuration Pattern

Before:

# Each service requested its own certificate
- traefik.http.routers.sonarr.tls.certresolver=letsencrypt
- traefik.http.routers.sonarr.tls.domains[0].main=tv.viewpoint.house

After:

# Traefik service requests wildcard certificates once
- traefik.http.routers.wildcard-viewpoint.rule=Host(`viewpoint.house`)
- traefik.http.routers.wildcard-viewpoint.tls.certresolver=letsencrypt
- traefik.http.routers.wildcard-viewpoint.tls.domains[0].main=viewpoint.house
- traefik.http.routers.wildcard-viewpoint.tls.domains[0].sans=*.viewpoint.house

# Services use wildcard certificate automatically
- traefik.http.routers.sonarr.tls=true

Services automatically match wildcard certificates via Traefik's TLS store without explicit resolver configuration.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.