refactor: remove HAProxy from Prospero, centralize TLS on Titania

Move TLS termination and reverse proxying entirely to Titania's
HAProxy, eliminating the redundant HAProxy instance on Prospero.
Backends now communicate over plain HTTP within the internal network.

- Remove HAProxy container, config, certs, and syslog from Prospero
- Remove ssl_backend flags from Titania backend definitions
- Replace pplg_haproxy_* vars with single pplg_domain variable
- Remove HAProxy syslog source from Alloy config
- Update OAuth2-Proxy to listen on all interfaces for Titania access

ansible/pplg/deploy.yml

@@ -1,6 +1,7 @@
 ---
 # PPLG - Consolidated Observability & Admin Stack for Prospero
-# PgAdmin, Prometheus, Loki, Grafana + HAProxy (TLS) + OAuth2-Proxy (Prometheus UI)
+# PgAdmin, Prometheus, Loki, Grafana + OAuth2-Proxy (Prometheus UI)
+# TLS termination handled by Titania HAProxy
 # Red Panda Approved
 
 - name: Deploy PPLG Stack
@@ -47,7 +48,6 @@
     ansible.builtin.apt:
       name:
         - acl
-        - haproxy
         - prometheus
         - loki
         - grafana
@@ -372,83 +372,6 @@
       state: started
       daemon_reload: true
 
-  # ===========================================================================
-  # SSL Certificate Distribution (from Titania)
-  # ===========================================================================
-
-  - name: Create haproxy group
-    ansible.builtin.group:
-      name: "{{pplg_haproxy_group}}"
-      gid: "{{pplg_haproxy_gid}}"
-      system: true
-
-  - name: Create haproxy user
-    ansible.builtin.user:
-      name: "{{pplg_haproxy_user}}"
-      comment: "PPLG HAProxy"
-      group: "{{pplg_haproxy_group}}"
-      uid: "{{pplg_haproxy_uid}}"
-      system: true
-
-  - name: Create HAProxy directories
-    ansible.builtin.file:
-      path: "{{item}}"
-      state: directory
-      owner: "{{pplg_haproxy_user}}"
-      group: "{{pplg_haproxy_group}}"
-      mode: '750'
-    loop:
-      - /etc/haproxy
-      - /etc/haproxy/certs
-
-  - name: Fetch wildcard certificate from Titania
-    ansible.builtin.fetch:
-      src: /etc/haproxy/certs/ouranos.pem
-      dest: /tmp/ouranos-haproxy.pem
-      flat: yes
-    delegate_to: titania.incus
-    when: "'titania.incus' in groups['ubuntu']"
-
-  - name: Deploy wildcard certificate
-    ansible.builtin.copy:
-      src: /tmp/ouranos-haproxy.pem
-      dest: "{{pplg_haproxy_cert_path}}"
-      owner: "{{pplg_haproxy_user}}"
-      group: "{{pplg_haproxy_group}}"
-      mode: '0640'
-    when: "'titania.incus' in groups['ubuntu']"
-
-  - name: Generate self-signed wildcard certificate (fallback)
-    command: >
-      openssl req -x509 -nodes -days 365 -newkey rsa:2048
-      -keyout {{pplg_haproxy_cert_path}}
-      -out {{pplg_haproxy_cert_path}}
-      -subj "/C=US/ST=State/L=City/O=Ouranos/CN=*.{{pplg_haproxy_domain}}"
-      -addext "subjectAltName=DNS:*.{{pplg_haproxy_domain}},DNS:{{pplg_haproxy_domain}}"
-    when: "'titania.incus' not in groups['ubuntu']"
-    args:
-      creates: "{{pplg_haproxy_cert_path}}"
-
-  # ===========================================================================
-  # HAProxy (TLS Termination)
-  # ===========================================================================
-
-  - name: Template HAProxy configuration
-    ansible.builtin.template:
-      src: pplg-haproxy.cfg.j2
-      dest: /etc/haproxy/haproxy.cfg
-      owner: "{{pplg_haproxy_user}}"
-      group: "{{pplg_haproxy_group}}"
-      mode: "640"
-      validate: haproxy -c -f %s
-    notify: restart haproxy
-
-  - name: Enable and start HAProxy service
-    ansible.builtin.systemd:
-      name: haproxy
-      enabled: true
-      state: started
-
   # ===========================================================================
   # Handlers
   # ===========================================================================
@@ -484,11 +407,6 @@
     ansible.builtin.systemd:
       daemon_reload: true
 
-  - name: restart haproxy
-    ansible.builtin.systemd:
-      name: haproxy
-      state: reloaded
-
   - name: restart oauth2-proxy-prometheus
     ansible.builtin.systemd:
       name: oauth2-proxy-prometheus