From 65478d9371465d3a479271d9535efaac672d6463 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Wed, 13 May 2026 22:34:00 +0100
Subject: [PATCH] Add lab subdomain

---
 ansible/roles/traefik/files/traefik.yml |  1 +
 terraform/desec.tf                      | 10 ++++++++++
 terraform/jakehoward.tech.tf            | 10 ++++++++++
 3 files changed, 21 insertions(+)

diff --git a/ansible/roles/traefik/files/traefik.yml b/ansible/roles/traefik/files/traefik.yml
index aa7efbf..cb64df1 100644
--- a/ansible/roles/traefik/files/traefik.yml
+++ b/ansible/roles/traefik/files/traefik.yml
@@ -28,6 +28,7 @@ entryPoints:
             sans: ["*.jakehoward.tech"]
           - main: 0rng.one
             sans: ["*.0rng.one"]
+          - main: "*.lab.jakehoward.tech"
         {% endif %}
     {% if ansible_hostname == "docker" %}
     proxyProtocol:
diff --git a/terraform/desec.tf b/terraform/desec.tf
index 7182285..76c296a 100644
--- a/terraform/desec.tf
+++ b/terraform/desec.tf
@@ -26,3 +26,13 @@ resource "desec_token_policy" "traefik_acme_challenge" {
 
   depends_on = [desec_token_policy.traefik_default]
 }
+
+resource "desec_token_policy" "traefik_lab_acme_challenge" {
+  token_id   = desec_token.traefik.id
+  perm_write = true
+  subname    = "_acme-challenge.lab"
+  domain     = "jakehoward.tech"
+  type       = "TXT"
+
+  depends_on = [desec_token_policy.traefik_default]
+}
diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf
index 7601f3c..2692848 100644
--- a/terraform/jakehoward.tech.tf
+++ b/terraform/jakehoward.tech.tf
@@ -329,6 +329,16 @@ resource "desec_rrset" "jakehowardtech_karakeep" {
   ]
 }
 
+resource "desec_rrset" "jakehowardtech_lab" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "*.lab"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
+  ]
+}
+
 resource "desec_rrset" "jakehowardtech_caa" {
   domain  = desec_domain.jakehowardtech.name
   subname = ""