try ingress-generated certs

apps/actual/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: actual
   namespace: actual
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
   - hosts:
     - actual.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+    secretName: actual-tls