Looks to be working as expected:

failed to reconnect session     {"obj": "csess", "id": "0eb6ded7abdf", "err": "failed to send authentication request: tls: failed to verify certificate: x509: certificate signed by unknown authority"}

with the standard agent ingress, which uses the internal ngrok CA rather than Let's Encrypt.

From meeting today:

1. Will instead add a root_cas option with similar semantics to the agent: https://ngrok.com/docs/ngrok-agent/config/#root_cas
2. The default will be internal and use the cert baked into ngrok-go. Caveat: if the special local directories exist and have certs, those will be used instead (same behavior as the controller currently uses).
3. The host option will use host certs, as this PR makes possible.
4. Any other values for root_cas will throw an error. In the future we may build functionality to refer to a k8s object here.

A table @jrobsonchase made of options, for posterity. We're going with the middle option: