Point Gitea OIDC at canonical identity.unkin.net and trust the internal CA

identity.unkin.net is now the canonical Authentik host. Gitea reaches it for
OIDC discovery/JWKS over TLS served by the internal unkin.net CA, which the
rootless image doesn't trust.

- Flip the authentik login source autoDiscoverUrl to identity.unkin.net.
- Mount the reflected vault-ca-cert and add it to Gitea's Go trust pool via
  SSL_CERT_DIR (additive; public roots stay intact).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Signed-off-by: Ben Vincent <ben@unkin.net>

apps/overlays/au-syd1/gitea/values.yaml

@@ -71,6 +71,30 @@ resources:
     cpu: "2"
     memory: 2Gi
 
+# Trust the internal unkin.net CA that signs identity.unkin.net's cert. Gitea is
+# Go, so SSL_CERT_DIR adds the mounted vault-ca-cert to the system trust pool
+# (additive — public roots stay via the default bundle). Needed for the OIDC
+# discovery/JWKS fetch at login.
+deployment:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/gitea/tls-ca
+extraVolumes:
+  - name: vault-ca-cert
+    secret:
+      secretName: vault-ca-cert
+      items:
+        - key: ca.crt
+          path: ca.crt
+extraContainerVolumeMounts:
+  - name: vault-ca-cert
+    mountPath: /etc/gitea/tls-ca
+    readOnly: true
+extraInitVolumeMounts:
+  - name: vault-ca-cert
+    mountPath: /etc/gitea/tls-ca
+    readOnly: true
+
 gitea:
   # Local admin fallback (survives the OIDC cutover). Secret keys: username,
   # password. Seeded in Vault -> synced to the gitea-admin Secret by VSO.
@@ -105,7 +129,7 @@ gitea:
     - name: "authentik"
       provider: "openidConnect"
       existingSecret: oauth-credentials
-      autoDiscoverUrl: "https://identity.k8s.syd1.au.unkin.net/application/o/gitea/.well-known/openid-configuration"
+      autoDiscoverUrl: "https://identity.unkin.net/application/o/gitea/.well-known/openid-configuration"
 
   config:
     server: