feat(ingress/legacy): wildcard TLS for private LBs (mirror k8s-native)

private (aws !acm_mode) → set wildcard_tls so the base issues a single wildcard
cert via the shim against gts-production, matching the old nginx_k8s_native pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf

@@ -57,9 +57,14 @@ locals {
   # terminates TLS with the ACM cert, no cert-manager involvement).
   cluster_issuer_override = lookup(var.instance.spec, "private", false) && !local.acm_mode ? "gts-production" : null
 
+  # Private + DNS-01 (non-ACM): one wildcard cert [domain, *.domain] per domain (single DNS-01
+  # challenge) via the listenerset-shim + gts-production, instead of per-hostname HTTP-01 certs.
+  wildcard_tls = lookup(var.instance.spec, "private", false) && !local.acm_mode
+
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {
       cluster_issuer_override = local.cluster_issuer_override
+      wildcard_tls            = local.wildcard_tls
     })
   })
 }

modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf

@@ -25,9 +25,14 @@ locals {
   # gts-production DNS-01 ClusterIssuer instead.
   cluster_issuer_override = lookup(var.instance.spec, "private", false) ? "gts-production" : null
 
+  # Private: one wildcard cert [domain, *.domain] per domain (single DNS-01 challenge)
+  # via the listenerset-shim + gts-production, instead of per-hostname HTTP-01 certs.
+  wildcard_tls = lookup(var.instance.spec, "private", false)
+
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {
       cluster_issuer_override = local.cluster_issuer_override
+      wildcard_tls            = local.wildcard_tls
     })
   })
 }

modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf

@@ -27,9 +27,14 @@ locals {
   # gts-production DNS-01 ClusterIssuer instead.
   cluster_issuer_override = lookup(var.instance.spec, "private", false) ? "gts-production" : null
 
+  # Private: one wildcard cert [domain, *.domain] per domain (single DNS-01 challenge)
+  # via the listenerset-shim + gts-production, instead of per-hostname HTTP-01 certs.
+  wildcard_tls = lookup(var.instance.spec, "private", false)
+
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {
       cluster_issuer_override = local.cluster_issuer_override
+      wildcard_tls            = local.wildcard_tls
     })
   })
 }