fix(adguard): drop retired adguard.forust.xyz from prod route so dns.forust.xyz gets LE cert

adguard.forust.xyz is NXDOMAIN (host retired); the combo SAN cert kept
failing and dns.forust.xyz served TRAEFIK DEFAULT CERT. Scope prod route
to dns.forust.xyz only.

Also commit live traefik-values state (remove letsencrypt-staging
resolver, live since helm rev 33).

adguardhome/k8s/ingress.yaml

@@ -7,7 +7,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
+    - match: Host(`dns.forust.xyz`)
       kind: Rule
       middlewares:
         - name: crowdsec-bouncer
@@ -15,7 +15,7 @@ spec:
       services:
         - name: adguard-service
           port: 3000
-    - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
+    - match: (Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
       kind: Rule
       services:
         - name: adguard-service

traefik/k8s/traefik-values.yaml

@@ -122,13 +122,6 @@ persistence:
   path: /data
 
 certificatesResolvers:
-  letsencrypt-staging:
-    acme:
-      email: bobrovod@national.shitposting.agency
-      storage: /data/letsencrypt/acme-staging.json
-      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
-      httpChallenge:
-        entryPoint: web
   letsencrypt:
     acme:
       email: bobrovod@national.shitposting.agency