env: create private cert issuer as part of new env
diff --git a/core/installer/welcome/env.go b/core/installer/welcome/env.go
index c11770c..c0f2f01 100644
--- a/core/installer/welcome/env.go
+++ b/core/installer/welcome/env.go
@@ -564,6 +564,20 @@
 		}
 	}
 	{
+		app, err := appsRepo.Find("certificate-issuer-private")
+		if err != nil {
+			return err
+		}
+		if err := appManager.Install(*app, nsGen, emptySuffixGen, map[string]any{
+			"APIConfigMap": map[string]any{
+				"Name":      "api-config", // TODO(gio): take from global pcloud config
+				"Namespace": fmt.Sprintf("%s-dns-zone-manager", pcloudEnvName),
+			},
+		}); err != nil {
+			return err
+		}
+	}
+	{
 		app, err := appsRepo.Find("core-auth")
 		if err != nil {
 			return err