[Feature]: Configurable service addressing mode (fqdn/hostname/ip)

Services address each other inconsistently and hardcoded: Elasticsearch discovery uses the IP from facts, kibana→ES uses group names (or localhost), the Beats outputs use group names, and setup.kibana would use a name too. The user cannot choose, yet the choice matters:

• no / unreliable DNS → IP is needed;
• multi-NIC hosts → pin the right network via IP;
• cert SANs → some PKIs issue DNS-only SANs (an IP connection then fails full);
• IP changes (VM migration, re-IP) → an FQDN stays valid, so no cert regeneration.

Introduce one shared variable that lets the user pick, overridable per host_vars/group_vars/play for mixed environments (e.g. a multi-NIC host on ip, the rest on fqdn).

Variable (roles/elasticstack/defaults/main.yml)

elasticstack_address_mode: fqdn        # choices: fqdn | hostname | ip
elasticstack_node_address: >-
  {{ {'fqdn':     ansible_fqdn,
      'hostname': ansible_hostname,
      'ip':       ansible_default_ipv4.address | default(ansible_all_ipv4_addresses[0])
     }[elasticstack_address_mode] }}

Because it references facts, hostvars[host].elasticstack_node_address resolves to that host's address in the chosen mode (Jinja evaluates it in the host's context).

Usage (HTTP layer)

{# setup.kibana (beats) #}
host: "http://{{ hostvars[groups[elasticstack_kibana_group_name] | first].elasticstack_node_address }}:{{ elasticstack_kibana_port }}"

{# beats ES output / kibana -> ES #}
{% for host in groups[elasticstack_elasticsearch_group_name] %}"https://{{ hostvars[host].elasticstack_node_address }}:{{ elasticstack_elasticsearch_http_port }}"{% endfor %}

Apply consistently to: kibana→ES, the Beats ES/Logstash outputs, and setup.kibana.

Transport / discovery stays IP

discovery.seed_hosts keeps the fact IP (works without any DNS). Optionally its own override, independent of the HTTP mode:

discovery.seed_hosts: [ {% for host in groups[...] %}"{{ hostvars[host].elasticsearch_seed_address | default(hostvars[host].ansible_default_ipv4.address) }}"{% endfor %} ]

Notes

• The Collection certificates already carry both --ip and --dns SANs, so switching mode needs no cert change.
• Default fqdn = production-idiomatic, migration-stable, matches the DNS SANs; relies on DNS or /etc/hosts (already a documented requirement).
• Molecule: set elasticstack_address_mode: ip and remove the temporary /etc/hosts workaround.

Implementation order: 1.0.0. Depends on: none — foundation for #514.

Start with roles/elasticstack/defaults/main.yml and inspect the templates for setup.kibana, Beats outputs, and Kibana-to-Elasticsearch URLs. Add the shared address mode consistently while keeping discovery.seed_hosts on fact IPs, then run the Molecule scenario with elasticstack_address_mode set to ip. Done means HTTP addresses follow the selected mode and the temporary /etc/hosts workaround is no longer needed.