[mtalvi]

Summary

• Add route.hostTemplate for the web UI and dashboard, with one {app} placeholder and DNS-label validation.
• Render each Route's spec.host from the same helper used for the VM's OAuth callback and allowed origin.
• Add ROUTE_HOST_TEMPLATE to quickstart and preserve a template supplied through SAW_VALUES_FILE.
• Add an opt-in for trusting the cluster ingress CA when an explicit OIDC issuer URL still points at this cluster. An explicit CA bundle keeps precedence.
• Document the settings and their precedence.
• Set the dashboard's standard user role to openshell-user, matching the gateway. Live owner login previously failed because the dashboard defaulted to user, despite the account already having the correct role. No user permissions are expanded.

Validation

• Rebased on current upstream/main (46a550b).
• make lint and make catalog-check pass.
• Chart and quickstart regression tests: 168 passed.
• Make interface tests: 82 passed.
• Dashboard/CLI follow-up regressions: 31 passed; lint (including 82 interface checks) and catalog checks pass.
• Gitleaks scan of both new commits: no findings.

The new settings default to off. A configured host template changes only the web UI and dashboard routes; the gateway passthrough route retains its normal hostname.

Live validation

Both custom auxiliary hostnames render consistently into their Routes, the OAuth callback, and the OpenClaw allowed origin. The user completed WebUI login in a Chrome profile using the SSH SOCKS tunnel and confirmed workspace display after the role-name configuration fix. The gateway's existing role checks and owner permissions are retained.

The legacy dashboard Route returns the documented OpenShell 0.1.x 503; its backend reachability is a pre-existing limitation. Public-internet issuer/certificate alignment and custom per-sandbox UI hosts remain separate follow-ups. The validation environment is retained at the user's request.