feat: support per-app letsencrypt emails on k3s

The `letsencrypt-email-prod` and `letsencrypt-email-stag` properties can now be set per app in addition to globally, resolving app-level before the global value for the app's selected `letsencrypt-server`. An app that sets its own email renders a namespaced cert-manager `Issuer` using that email, while apps without an override continue to use the shared `ClusterIssuer` with the global email.

plugins/scheduler-k3s/templates/chart/certificate.yaml

@@ -22,7 +22,7 @@ metadata:
   namespace: {{ $.Values.global.namespace }}
 spec:
   issuerRef:
-    kind: ClusterIssuer
+    kind: {{ $config.web.tls.issuer_kind | default "ClusterIssuer" }}
     name: {{ $config.web.tls.issuer_name }}
   secretName: tls-{{ $.Values.global.app_name }}-{{ $processName }}
   secretTemplate:

plugins/scheduler-k3s/templates/chart/issuer.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.global.issuer.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  annotations:
+    dokku.com/managed: "true"
+  labels:
+    app.kubernetes.io/name: {{ .Values.global.issuer.name }}
+    app.kubernetes.io/part-of: {{ .Values.global.app_name }}
+  name: {{ .Values.global.issuer.name }}
+  namespace: {{ .Values.global.namespace }}
+spec:
+  acme:
+    email: {{ .Values.global.issuer.email }}
+    server: {{ .Values.global.issuer.server }}
+    privateKeySecretRef:
+      name: {{ .Values.global.issuer.name }}
+    solvers:
+    - http01:
+        ingress:
+          class: {{ .Values.global.issuer.ingress_class }}
+{{- end }}