feat: use the staging lets encrypt certificate by default to prevent being rate limited

Signed-off-by: Devin Buhl <devin@buhl.casa>

README.md

@@ -382,7 +382,7 @@ task cluster:resources
 
 ☢️ If you run into problems, you can run `task ansible:nuke` to destroy the k3s cluster and start over.
 
-🧠 Now it's time to pause and go get some coffee ☕ because next is describing how DNS is handled.
+🧠 Now it's time to pause and go get some coffee ☕ because next is describing additional things like how DNS is handled.
 
 ## 📣 Post installation
 
@@ -390,9 +390,18 @@ task cluster:resources
 
 [direnv](https://direnv.net/) will make it so anytime you `cd` to your repo's directory it export the required environment variables (e.g. `KUBECONFIG`). To set this up make sure you [hook it into your shell](https://direnv.net/docs/hook.html) and after that is done, run `direnv allow` while in your repos directory.
 
+### 📜 Certificates
+
+By default this template will deploy a wildcard certificate with the Let's Encrypt staging servers. This is to prevent you from getting rate-limited on configuration that might not be valid on bootstrap using the production server. Once you have confirmed the certificate is created and valid, make sure to switch to the Let's Encrypt production servers as outlined in the certificate manifest.
+
+- To view the certificate request run `kubectl -n networking get certificaterequests`
+- To verify the certificate is created run `kubectl -n networking get certificates`
+
+📍 Do not enable the production certificate until you are sure you will keep the cluster up for more than a few hours.
+
 ### 🌐 DNS
 
-📍 The `external-dns` application created in the `networking` namespace will handle creating public DNS records. By default, `echo-server` and the `flux-webhook` are the only public sub-domains exposed. In order to make additional applications public you must set an ingress annotation (`external-dns.alpha.kubernetes.io/target`) like done in the `HelmRelease` for `echo-server`.
+The `external-dns` application created in the `networking` namespace will handle creating public DNS records. By default, `echo-server` and the `flux-webhook` are the only public sub-domains exposed. In order to make additional applications public you must set an ingress annotation (`external-dns.alpha.kubernetes.io/target`) like done in the `HelmRelease` for `echo-server`.
 
 For split DNS to work it is required to have `${SECRET_DOMAIN}` point to the `${METALLB_K8S_GATEWAY_ADDR}` load balancer IP address on your home DNS server. This will ensure DNS requests for `${SECRET_DOMAIN}` will only get routed to your `k8s_gateway` service thus providing **internal** DNS resolution to your cluster applications/ingresses from any device that uses your home DNS server.