Create at your dns domain provider a cname record *.cloud.domain.com to your caddy ip and in caddy use always services.cloud.domain.com, service2.cloud.domain.com,..

Use it this way so I don’t need to add to every service a new cname record.

And caddy creates for every service a own cert.. no wildcard ..