dns: keep VM consul forwarder as fallback

WAN federation through mesh gateways makes Consul verify server certs against `server.<dc>.consul` and `<node_name>.server.<dc>.consul`. Node names are FQDNs, so each server needs its exact SAN. This adds the SANs ahead of Consul server TLS, which a stacked follow-up enables once the reissued certs are verified.

- add `server.<country>-<region>.consul` to consul server alt_names
- add `<fqdn>.server.<country>-<region>.consul` to consul server alt_names

Reviewed-on: #547
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/country/au/region/syd1.yaml

@@ -4,6 +4,7 @@ certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
 profiles_dns_upstream_forwarder_unkin:
   - 198.18.200.7
 profiles_dns_upstream_forwarder_consul:
+  - 198.18.200.5
   - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:
   - 198.18.19.20

hieradata/roles/infra/storage/consul.yaml

@@ -31,6 +31,8 @@ profiles::pki::vault::alt_names:
   - consul.service.consul
   - "consul.service.%{facts.country}-%{facts.region}.consul"
   - consul
+  - "server.%{facts.country}-%{facts.region}.consul"
+  - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"
 
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'