Use *.internal.trails.cool wildcard for internal services

Add wildcard DNS record for *.internal.trails.cool (A + AAAA) so
internal services don't leak hostnames in individual DNS entries.
Move Grafana from grafana.trails.cool to grafana.internal.trails.cool.

Future internal services just need a Caddy block — no DNS changes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/Caddyfile

@@ -28,7 +28,7 @@ www.{$DOMAIN:trails.cool} {
 	redir https://{$DOMAIN:trails.cool}{uri} permanent
 }
 
-grafana.{$DOMAIN:trails.cool} {
+grafana.internal.{$DOMAIN:trails.cool} {
 	basicauth {
 		{$GRAFANA_USER:admin} {$GRAFANA_PASSWORD_HASH}
 	}

infrastructure/docker-compose.yml

@@ -107,7 +107,7 @@ services:
     environment:
       GF_SECURITY_ADMIN_USER: ${GRAFANA_USER:-admin}
       GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
-      GF_SERVER_ROOT_URL: https://grafana.${DOMAIN:-trails.cool}
+      GF_SERVER_ROOT_URL: https://grafana.internal.${DOMAIN:-trails.cool}
     volumes:
       - ./grafana/provisioning:/etc/grafana/provisioning:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards:ro

infrastructure/terraform/main.tf

@@ -122,6 +122,25 @@ resource "hcloud_zone_rrset" "planner_aaaa" {
   records = [{ value = hcloud_server.trails.ipv6_address }]
 }
 
+# Internal wildcard — all *.internal.trails.cool resolves to the server.
+# Caddy handles routing per-subdomain. No individual DNS entries needed
+# for internal services (Grafana, Prometheus, etc.)
+resource "hcloud_zone_rrset" "internal_wildcard_a" {
+  zone = "trails.cool"
+  name = "*.internal"
+  type = "A"
+  ttl  = 300
+  records = [{ value = hcloud_server.trails.ipv4_address }]
+}
+
+resource "hcloud_zone_rrset" "internal_wildcard_aaaa" {
+  zone = "trails.cool"
+  name = "*.internal"
+  type = "AAAA"
+  ttl  = 300
+  records = [{ value = hcloud_server.trails.ipv6_address }]
+}
+
 resource "hcloud_zone_rrset" "www_cname" {
   zone = "trails.cool"
   name = "www"