Make FIFA17 roster hostname configurable

fifa17-recon/docker/fifa17-python/Dockerfile

@@ -37,18 +37,14 @@ RUN set -eu; \
 
 COPY data/ /app/data/
 
-# Redirector/roster TLS cert (CN/SAN = winter15.gosredirector.ea.com). ProtoSSL
-# cert-verify is patched client-side, so a self-signed cert is fine — but the
-# client dials the roster and redirector BY IP, and that path still checks the
-# SAN against the dialed address (it is NOT covered by the two patched gates), so
-# a cert without a matching IP SAN is rejected with fatal certificate_unknown
-# (docs/FIFA17_FUT_SQUAD_UPDATE_TLS.md). The advertised LAN IP is a RUNTIME value,
-# unknown here, so this bakes only a loopback-IP baseline and the entrypoint
-# reissues with IP:$OPENFUT_ADVERTISE at start.
+# Redirector/roster TLS certificate. FIFA17's roster verifier compares only
+# dNSName SAN entries, so deployment advertises winter15.gosredirector.ea.com
+# through OPENFUT_ROSTER_HOST and resolves that hostname on the client. The
+# entrypoint validates this stable certificate; it never reissues it for an IP
+# SAN that the verifier ignores.
 #
-# openssl therefore has to remain in the image for the entrypoint, not be dropped
-# with the apt lists. The pair is git-ignored (*.pem/*.key); regenerate if absent
-# so a fresh checkout builds without extra steps.
+# OpenSSL remains in the image both to create the git-ignored keypair on a fresh
+# checkout and to validate the configured DNS identity at startup.
 RUN apt-get update && apt-get install -y --no-install-recommends openssl && \
     rm -rf /var/lib/apt/lists/*
 RUN if [ ! -s tools/redir_cert.pem ] || [ ! -s tools/redir_key.pem ]; then \