refstack: use CNAME for production server

The production server is trying to send itself to
refstack01.openstack.org, causing cross-site scripting issues.  In
production, use the CNAME, but use the FQDN for testing.

Fix up job file matchers while here.

Change-Id: I18a5067ee25c59c5eaa17b7c2d9bd5a942a9173d

inventory/service/group_vars/refstack-docker.yaml

@@ -1,2 +1,2 @@
-refstack_url: 'https://{{ ansible_fqdn }}'
+refstack_url: 'https://refstack.openstack.org'
 refstack_openid_endpoint: https://openstackid.org

playbooks/zuul/templates/group_vars/refstack-docker.yaml.j2

@@ -1,3 +1,7 @@
+# NOTE(ianw): we set to the FQDN in the gate to avoid the
+# server trying to talk to the production CNAME; the gate testing
+# has overridden hosts for the FQDN to be localhost
+refstack_url: 'https://{{ ansible_fqdn }}'
 refstack_db_username: refstack
 refstack_db_password: Jz4ooq9TL7nc3hX3
 refstack_root_db_password: KbgY3r9HYnEYpgRP

zuul.d/system-config-run.yaml

@@ -912,9 +912,8 @@
       container_command: docker
     files:
       - playbooks/bridge.yaml
-      - playbooks/group_vars/refstack.yaml
-      - playbooks/host_vars/gitea.*
-      - playbooks/zuul/templates/group_vars/refstack.yaml.j2
+      - inventory/service/group-vars/refstack-docker.yaml
+      - playbooks/zuul/templates/group_vars/refstack-docker.yaml.j2
       - playbooks/roles/refstack/
       - playbooks/roles/letsencrypt-create-certs/handlers/restart_apache.yaml
       - testinfra/test_refstack.py