Wildcard TLS for a self-hosted homelab — Cloudflare DNS-01, end to end

How I gave eight internal services real Let's Encrypt certificates with one wildcard, no port forwards, and automated renewal. Walks through the Cloudflare token, acme.sh setup, nginx wiring, and the gotchas that bit me.