Serve grafana.unkin.net from traefik-external (#522)

grafana.unkin.net still routes through the puppet haproxy edge to the old grafana VMs; the k8s grafana should serve it directly like identity and vlogs.

- add grafana-external Gateway (traefik-external, *.unkin.net wildcard) with redirect + main HTTPRoutes
- reflect wildcard-unkin-net-tls into grafana
- set grafana root_url to https://grafana.unkin.net
- add grafana A record -> 198.18.199.0 in the bind-operator unkin.net zone
- drop grafana.unkin.net from the k8s haproxy routes and config

Requires terraform-authentik grafana redirect URI PR applied first, and the puppet halb vrrp_cnames grafana.unkin.net CNAME removed.

Reviewed-on: #522
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/haproxy/configmap.yaml

@@ -21,7 +21,6 @@ data:
     jellyfin.main.unkin.net be_jellyfin
     fafflix.unkin.net be_jellyfin
     git.unkin.net be_gitea
-    grafana.unkin.net be_grafana
     dashboard.ceph.unkin.net be_ceph_dashboard
     auth.unkin.net be_k8s_kanidm
 
@@ -124,23 +123,6 @@ data:
       server ausyd1nxvm2081 198.18.27.117:443 check cookie ausyd1nxvm2081 fall 2 inter 2s rise 3 ssl verify none
       server ausyd1nxvm2082 198.18.28.71:443 check cookie ausyd1nxvm2082 fall 2 inter 2s rise 3 ssl verify none
 
-    backend be_grafana
-      description Backend for grafana nodes
-      balance roundrobin
-      cookie SRVNAME insert indirect nocache
-      http-request set-header X-Forwarded-Port %[dst_port]
-      http-request add-header X-Forwarded-Proto https if { dst_port 443 }
-      http-reuse always
-      option httpchk GET /
-      option forwardfor
-      option http-keep-alive
-      option prefer-last-server
-      redirect scheme https if !{ ssl_fc }
-      stick on src
-      stick-table type ip size 200k expire 30m
-      server ausyd1nxvm2015 198.18.27.2:443 check cookie ausyd1nxvm2015 fall 2 inter 2s rise 3 ssl verify none
-      server ausyd1nxvm2016 198.18.28.189:443 check cookie ausyd1nxvm2016 fall 2 inter 2s rise 3 ssl verify none
-
     backend be_jellyfin
       description Backend for au-syd1 jellyfin
       balance roundrobin

apps/base/haproxy/httproute.yaml

@@ -17,7 +17,6 @@ spec:
     - jellyfin.main.unkin.net
     - fafflix.unkin.net
     - git.unkin.net
-    - grafana.unkin.net
     - dashboard.ceph.unkin.net
     - auth.unkin.net
   parentRefs:

apps/base/haproxy/tlsroute.yaml

@@ -17,7 +17,6 @@ spec:
     - jellyfin.main.unkin.net
     - fafflix.unkin.net
     - git.unkin.net
-    - grafana.unkin.net
     - dashboard.ceph.unkin.net
     - auth.unkin.net
   parentRefs: