feat(ingress): add prod-hostname rules + drop *.k. from app config

Adds <app>.renner.uno as a second host rule and TLS SAN on each test
Ingress (authentik, paperless/docs, audiobookshelf, ical-proxy, grafana).
With the external-dns domain filter now scoped to k.renner.uno, these
prod hostnames cannot be written back into UniFi by external-dns — the
prod CNAMEs managed by OpenTofu stay pointed at the Caddy VIP, while
the K8s ingress now accepts traffic arriving with a prod Host header
(e.g. from a Kasm session whose extra_hosts maps *.renner.uno to the
cluster LB 10.2.40.80).

Also removes *.k.renner.uno from app-level config where it was baked
in as cruft: PAPERLESS_URL, Grafana root_url, Grafana OIDC auth_url
are now prod hostnames — matching the architectural intent that the
K8s cluster IS the future prod. PAPERLESS_CSRF_TRUSTED_ORIGINS keeps
both variants during transition so existing *.k.renner.uno browsing
doesn't immediately break on form POSTs.

cert-manager will issue fresh letsencrypt-staging certs with the
expanded SAN set via DNS-01; no public DNS changes needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/audiobookshelf/ingress.yaml

@@ -19,7 +19,18 @@ spec:
                 name: audiobookshelf
                 port:
                   number: 80
+    - host: audiobooks.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: audiobookshelf
+                port:
+                  number: 80
   tls:
     - secretName: audiobookshelf-tls
       hosts:
         - audiobooks.k.renner.uno
+        - audiobooks.renner.uno

kubernetes/apps/authentik/ingress-test.yaml

@@ -20,7 +20,18 @@ spec:
                 name: authentik-server
                 port:
                   number: 80
+    - host: auth.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: authentik-server
+                port:
+                  number: 80
   tls:
     - secretName: authentik-test-tls
       hosts:
         - auth.k.renner.uno
+        - auth.renner.uno

kubernetes/apps/ical-proxy/deployment.yaml

@@ -82,7 +82,18 @@ spec:
                 name: ical-proxy
                 port:
                   number: 80
+    - host: ical-proxy.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ical-proxy
+                port:
+                  number: 80
   tls:
     - secretName: ical-proxy-tls
       hosts:
         - ical-proxy.k.renner.uno
+        - ical-proxy.renner.uno

kubernetes/apps/monitoring/helmrelease-prometheus.yaml

@@ -87,10 +87,12 @@ spec:
           cert-manager.io/cluster-issuer: letsencrypt-staging
         hosts:
           - dash.k.renner.uno
+          - dash.renner.uno
         tls:
           - secretName: grafana-tls
             hosts:
               - dash.k.renner.uno
+              - dash.renner.uno
       persistence:
         enabled: true
         storageClassName: ceph-block
@@ -108,13 +110,13 @@ spec:
         - name: grafana-oauth
       grafana.ini:
         server:
-          root_url: https://dash.k.renner.uno
+          root_url: https://dash.renner.uno
         auth.generic_oauth:
           enabled: true
           name: Authentik
           allow_sign_up: true
           scopes: openid profile email
-          auth_url: https://auth.k.renner.uno/application/o/authorize/
+          auth_url: https://auth.renner.uno/application/o/authorize/
           token_url: http://authentik-server.authentik.svc.cluster.local/application/o/token/
           api_url: http://authentik-server.authentik.svc.cluster.local/application/o/userinfo/
           use_pkce: true

kubernetes/apps/paperless/paperless.yaml

@@ -7,8 +7,8 @@ data:
   # OIDC via django-allauth; client_id + secret injected from the secret as env
   # PAPERLESS_SOCIALACCOUNT_PROVIDERS expects a JSON string
   PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
-  PAPERLESS_URL: "https://paperless.k.renner.uno"
-  PAPERLESS_CSRF_TRUSTED_ORIGINS: "https://paperless.k.renner.uno,https://docs.k.renner.uno"
+  PAPERLESS_URL: "https://paperless.renner.uno"
+  PAPERLESS_CSRF_TRUSTED_ORIGINS: "https://paperless.renner.uno,https://docs.renner.uno,https://paperless.k.renner.uno,https://docs.k.renner.uno"
   PAPERLESS_ALLOWED_HOSTS: "*"
   PAPERLESS_TIME_ZONE: "Europe/Berlin"
   PAPERLESS_OCR_LANGUAGE: "deu+eng"
@@ -167,8 +167,30 @@ spec:
                 name: paperless
                 port:
                   number: 80
+    - host: paperless.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: paperless
+                port:
+                  number: 80
+    - host: docs.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: paperless
+                port:
+                  number: 80
   tls:
     - secretName: paperless-tls
       hosts:
         - paperless.k.renner.uno
         - docs.k.renner.uno
+        - paperless.renner.uno
+        - docs.renner.uno