unkinben
435057b034
identity.unkin.net is now the canonical Authentik host. Grafana, LiteLLM and NetBox reach it over TLS served by the internal unkin.net CA, which their images don't trust, so OIDC/discovery failed with x509 unknown-authority. NetBox also still pointed at the secondary admin host. - grafana: mount the reflected vault-ca-cert and set generic_oauth tls_client_ca. - litellm: combine-certs init builds a public+internal CA bundle; SSL_CERT_FILE and REQUESTS_CA_BUNDLE point at it. - netbox: flip the OIDC issuer to identity.unkin.net; same combine-certs bundle for python-social-auth (requests). - docs: record the Rancher manual runtime step (issuer + CA in the auth config). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Signed-off-by: Ben Vincent <ben@unkin.net>