I’m running all my services behind Traefik, which handles getting a wildcard cert for all my (sub)domains with letsencrypt.

Once I figured out how to write the config properly, I haven’t had to touch it again, pretty happy with the result.