Caddy wildcard + custom domains

Caddyfile

{
    on_demand_tls {
        ask http://12.34.56.78/caddy-check
    }
    email hi@example.com
}
*.example.com {
    tls ...custom certs...

    reverse_proxy http://12.34.56.78
}
:80 {
    redir https://{host}{uri}
}
:443 {
    tls {
        on_demand
        issuer zerossl ...
        issuer acme
    }
    reverse_proxy http://12.34.56.78 {
        header_up Host {host}
        header_up X-Forwarded-Port {server_port}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Proto {scheme}
        health_timeout 5s
    }
}