fix tls: use letsencrypt-prod cluster-issuer for jellyfin/n8n/qbittorrent/myorg/phoenix/fava

The ingresses referenced a Cloudflare OriginIssuer 'prod-issuer' whose CRD
and controller are not installed in the cluster, so cert-manager could not
issue certs and Traefik served a default cert (invalid SSL). Switch to the
existing letsencrypt-prod ClusterIssuer with specific hostnames + per-app
secrets, matching the working ingresses (http-01 cannot issue wildcards).

fava/ingress.yaml

@@ -7,9 +7,7 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: "traefik"
     traefik.ingress.kubernetes.io/redirect-entry-point: https
-    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/cluster-issuer: letsencrypt-prod
-    cert-manager.io/issuer-kind: OriginIssuer
-    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
 spec:
   tls:
     - hosts:

jellyfin/ingress.yaml

@@ -7,14 +7,12 @@ metadata:
     kubernetes.io/ingress.class: "traefik"
     traefik.ingress.kubernetes.io/redirect-entry-point: https
     traefik.ingress.kubernetes.io/compress: "true"
-    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/cluster-issuer: letsencrypt-prod
-    cert-manager.io/issuer-kind: OriginIssuer
-    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
 spec:
   tls:
     - hosts:
-      - "*.rogi.casa"
+      - jellyfin.rogi.casa
-      secretName: rogicasa-tls
+      secretName: jellyfin-tls
   rules:
   - host: jellyfin.rogi.casa
     http:

myorg-assistant/ingress.yaml

@@ -10,14 +10,12 @@ metadata:
     traefik.ingress.kubernetes.io/redirect-entry-point: https
     # Optional: enable compression
     traefik.ingress.kubernetes.io/compress: "true"
-    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/cluster-issuer: letsencrypt-prod
-    cert-manager.io/issuer-kind: OriginIssuer
-    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
 spec:
   tls:
     - hosts:
-      - "*.rogi.casa"
+      - myorg.rogi.casa
-      secretName: rogicasa-tls
+      secretName: myorg-tls
   rules:
   - host: myorg.rogi.casa
     http:

n8n/ingress.yaml

@@ -10,14 +10,12 @@ metadata:
     traefik.ingress.kubernetes.io/redirect-entry-point: https
     # Optional: enable compression
     traefik.ingress.kubernetes.io/compress: "true"
-    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/cluster-issuer: letsencrypt-prod
-    cert-manager.io/issuer-kind: OriginIssuer
-    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
 spec:
   tls:
     - hosts:
-      - "*.rogi.casa"
+      - n8n.rogi.casa
-      secretName: rogicasa-tls
+      secretName: n8n-tls
   rules:
   - host: n8n.rogi.casa
     http:

phoenix/ingress.yaml

@@ -10,14 +10,12 @@ metadata:
     traefik.ingress.kubernetes.io/redirect-entry-point: https
     # Optional: enable compression
     traefik.ingress.kubernetes.io/compress: "true"
-    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/cluster-issuer: letsencrypt-prod
-    cert-manager.io/issuer-kind: OriginIssuer
-    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
 spec:
   tls:
     - hosts:
-      - "*.rogi.casa"
+      - phoenix.rogi.casa
-      secretName: rogicasa-tls
+      secretName: phoenix-tls
   rules:
   - host: phoenix.rogi.casa
     http:

qbittorrent/ingress.yaml

@@ -7,14 +7,12 @@ metadata:
     kubernetes.io/ingress.class: "traefik"
     traefik.ingress.kubernetes.io/redirect-entry-point: https
     traefik.ingress.kubernetes.io/compress: "true"
-    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/cluster-issuer: letsencrypt-prod
-    cert-manager.io/issuer-kind: OriginIssuer
-    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
 spec:
   tls:
     - hosts:
-      - "*.rogi.casa"
+      - qbittorrent.rogi.casa
-      secretName: rogicasa-tls
+      secretName: qbittorrent-tls
   rules:
   - host: qbittorrent.rogi.casa
     http: