[l-nmch]

What

Route console.phorge.fr to the ingress of the svc cluster, where the console is hosted (decision 0008 of Hangar). templates/haproxy.cfg.tftpl gets the HTTP redirect to HTTPS and the SNI route to https-svc-ingress, written like the ones of git.phorge.fr. The host is added to the table of public hosts in docs/reference/network-plan.md.

Why

The edge sends a host it does not know to the control ingress, so without a route console.phorge.fr would reach the wrong cluster.

Checked

• tofu validate passes. The targeted plan on routeros_file.files["usb1/haproxy-etc/haproxy.cfg"] replaces that one file (1 to add, 1 to destroy), and the only difference in its contents is the added console.phorge.fr lines. Nothing else is in the plan.
• No firewall change: https-svc-ingress already exists for git.phorge.fr.
• No DNS record to create: an unknown host under phorge.fr already resolves to the WAN address (wildcard).
• scripts/check_docs.py: layout and headers ok.

Not covered

• Nothing answers on console.phorge.fr yet: the console is not deployed, and its Traefik route and certificate (cert-manager) come with its Deployment on svc.
• tofu fmt -check reports terraform.tfvars; I did not touch that file.

Apply

The maintainer runs tofu apply. The container reloads HAProxy by itself (decision 0002).

Closes #30