Identity gateway migrated to traefik-external (198.18.199.0); watchstate added to wildcard cert reflector lists

apps/base/bind-internal/authoritative/records.yaml

@@ -16,9 +16,9 @@ spec:
   type: A
   ttl: 600
   values:
-    # traefik-internal gateway VIP; the authentik Gateway serves the
+    # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
     # identity.unkin.net hostname there.
-    - 198.18.200.4
+    - 198.18.199.0
 ---
 # PRODUCTION CUTOVER RECORD — intentionally commented out.
 # git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate"
   privateKey:
     size: 4096
   dnsNames: