watchstate: expose externally at watchstate.unkin.net

Add a public front door for the WatchState admin UI on watchstate.unkin.net
via the external (DMZ) Traefik, alongside the existing internal
watchstate.k8s.syd1.au.unkin.net gateway. oauth2-proxy fronts both hostnames.

- DNSRecord watchstate-dns-internal (bind-internal/authoritative, unkin.net
  zone) -> A 198.18.199.0, the traefik-external VIP (arrstack precedent).
- watchstate-external Gateway (traefik-external) + HTTPRoutes: http->https
  redirect and https -> watchstate-oauth2:80. TLS terminated with the
  Let's Encrypt *.unkin.net wildcard (wildcard-unkin-net-tls), so no
  cert-manager/external-dns annotations.
- oauth2-proxy: relative redirect-url (/oauth2/callback) so reverse-proxy mode
  derives scheme+host per request, making the callback work on BOTH hosts;
  cookie + whitelist domains cover both hostnames.
- Drop the no-op sync-wave: "0" annotation on the vaultauth default VaultAuth.

Dependencies:
- wildcard-unkin-net-tls reflection into the watchstate namespace (reflector
  allow-list, argocd-apps PR #418).
- Both callback URIs registered on the Authentik watchstate provider
  (terraform-authentik, separate PR).

apps/base/arrstack/arrproxy/gateway.yaml

@@ -1,11 +1,9 @@
 ---
 # External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). The apex arrstack.unkin.net A record
+# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
-# lives in the bind-operator unkin.net zone (bind-internal/authoritative), NOT
+# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
-# external-dns, so no external-dns annotation here. Public TLS is terminated with
+# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
-# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# NOT external-dns, so no external-dns annotation here.
-# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
-# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -13,6 +11,9 @@ metadata:
     traefik.io/instance: external
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: arrstack.unkin.net
+    cert-manager.io/private-key-size: "4096"
   name: arrproxy
   namespace: arrstack
 spec:
@@ -37,4 +38,4 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: wildcard-unkin-net-tls
+            name: arrproxy-gateway-tls

apps/base/authentik/gateway.yaml

@@ -1,47 +1,4 @@
 ---
-# External (DMZ) front for public identity.unkin.net, served via the external
-# Traefik (LB VIP 198.18.199.0). The apex identity.unkin.net A record lives in
-# the bind-operator unkin.net zone (bind-internal/authoritative), NOT
-# external-dns, so no external-dns annotation here. Public TLS is terminated with
-# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
-# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
-# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: external
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: authentik
-  namespace: authentik
-spec:
-  gatewayClassName: traefik-external
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: wildcard-unkin-net-tls
-        mode: Terminate
----
-# Cluster hostname variant, identity.k8s.syd1.au.unkin.net. Internal Traefik,
-# external-dns at 198.18.200.4. Own leaf from the Vault PKI issuer via the
-# cert-manager gateway-shim; the common-name keys off this cluster host.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -49,11 +6,11 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: identity.unkin.net
     cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: identity.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: authentik-internal
+  name: authentik
   namespace: authentik
 spec:
   gatewayClassName: traefik-internal
@@ -61,14 +18,14 @@ spec:
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: identity.k8s.syd1.au.unkin.net
+      hostname: identity.unkin.net
       name: http
       port: 80
       protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: identity.k8s.syd1.au.unkin.net
+      hostname: identity.unkin.net
       name: https
       port: 443
       protocol: HTTPS
@@ -78,3 +35,23 @@ spec:
             kind: Secret
             name: authentik-tls
         mode: Terminate
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: http-internal
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: identity.k8s.syd1.au.unkin.net
+      name: https-internal
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: authentik-tls
+        mode: Terminate

apps/base/authentik/httproute.yaml

@@ -7,11 +7,16 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: http
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik
+      sectionName: http-internal
   rules:
     - filters:
         - type: RequestRedirect
@@ -31,60 +36,16 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
+    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: https
-  rules:
+    - group: gateway.networking.k8s.io
-    - backendRefs:
+      kind: Gateway
-        - group: ""
+      name: authentik
-          kind: Service
+      sectionName: https-internal
-          name: authentik-server
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik-http-redirect-internal
-  namespace: authentik
-spec:
-  hostnames:
-    - identity.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-internal
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik-internal
-  namespace: authentik
-spec:
-  hostnames:
-    - identity.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-internal
-      sectionName: https
   rules:
     - backendRefs:
         - group: ""

apps/base/bind-internal/authoritative/records.yaml

@@ -16,9 +16,9 @@ spec:
   type: A
   ttl: 600
   values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
+    # traefik-internal gateway VIP; the authentik Gateway serves the
     # identity.unkin.net hostname there.
-    - 198.18.199.0
+    - 198.18.200.4
 ---
 # PRODUCTION CUTOVER RECORD — intentionally commented out.
 # git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
@@ -135,21 +135,6 @@ spec:
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: DNSRecord
-metadata:
-  name: cheeztv-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: cheeztv
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net
-    # there.
-    - 198.18.200.4
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
 metadata:
   name: watchstate-dns-internal
   namespace: bind-internal

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
   privateKey:
     size: 4096
   dnsNames: