ci(prod): add image build workflow for prod deployments

.gitea/workflows/build-prod.yaml

@@ -0,0 +1,36 @@
+name: build-prod
+
+on:
+  push:
+    branches: [prod]
+
+jobs:
+  build-push:
+    runs-on: docker
+    permissions:
+      packages: write
+    steps:
+      - name: install buildx and git
+        run: apk add --no-cache docker git
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push image (commit SHA + latest)
+        run: |
+          COMMIT_SHA=${{ github.sha }}
+          SHORT_SHA=${COMMIT_SHA:0:7}
+          IMAGE_NAME="forgejo.riotpiao.com/rock/kmsvc-manage"
+          
+          docker build \
+            -t ${IMAGE_NAME}:${SHORT_SHA} \
+            -t ${IMAGE_NAME}:latest \
+            .
+          
+          # For now, tag locally. When registry auth is configured:
+          # docker push ${IMAGE_NAME}:${SHORT_SHA}
+          # docker push ${IMAGE_NAME}:latest
+          
+          echo "Built image: ${IMAGE_NAME}:${SHORT_SHA} and ${IMAGE_NAME}:latest"

k8s/argocd/apps/00-strimzi-operator.yaml

@@ -2,7 +2,7 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: strimzi-operator
-  namespace: cicd
+  namespace: sqs
   annotations:
     argocd.argoproj.io/sync-wave: "0"
 spec:

k8s/argocd/apps/01-kafka-cluster.yaml

@@ -2,14 +2,14 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: kafka-cluster
-  namespace: cicd
+  namespace: sqs
   annotations:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   project: kmsvc
   source:
-    repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    repoURL: https://forgejo.riotpiao.com/rock/kmsvc-manage.git
-    targetRevision: main
+    targetRevision: prod
     path: k8s/charts/kafka-cluster
     helm:
       values: |

k8s/argocd/apps/02-redis.yaml

@@ -2,7 +2,7 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: kmsvc-redis
-  namespace: cicd
+  namespace: sqs
   annotations:
     argocd.argoproj.io/sync-wave: "1"
 spec:

k8s/argocd/apps/03-queue-crd.yaml

@@ -2,14 +2,14 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: queue-crd
-  namespace: cicd
+  namespace: sqs
   annotations:
     argocd.argoproj.io/sync-wave: "2"
 spec:
   project: kmsvc
   source:
-    repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    repoURL: https://forgejo.riotpiao.com/rock/kmsvc-manage.git
-    targetRevision: main
+    targetRevision: prod
     path: k8s/charts/queue-crd
     helm:
       values: |

k8s/argocd/apps/04-management-service.yaml

@@ -2,31 +2,31 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: management-service
-  namespace: cicd
+  namespace: sqs
   annotations:
     argocd.argoproj.io/sync-wave: "2"
 spec:
   project: kmsvc
   source:
-    repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    repoURL: https://forgejo.riotpiao.com/rock/kmsvc-manage.git
-    targetRevision: main
+    targetRevision: prod
     path: k8s/charts/management-service
     helm:
       values: |
         namespace: sqs
         image:
-          repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service
+          repository: forgejo.riotpiao.com/rock/kmsvc-manage
-          # CI (.forgejo/workflows/release.yaml) writes the released git tag
+          # On prod branch: built on each commit push via CI workflow
-          # here and pushes the commit -- ArgoCD picks it up on its next sync.
+          # Tag is set to the git commit SHA for reproducible deployments
           tag: latest
         env:
           kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
           redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
-          authentikIssuerURL: "https://authentik.riotpiao.homelab.com/application/o/kafaka/"
+          authentikIssuerURL: ""
-          authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"
+          authentikAudience: ""
         ingress:
           enabled: true
-          host: kmsvc.riotpiao.homelab.com
+          host: kmsvc.riotpiao.com
           clusterIssuer: homelab-ca
   destination:
     server: https://kubernetes.default.svc

k8s/argocd/root.yaml

@@ -7,13 +7,13 @@ spec:
   project: kmsvc
   source:
     repoURL: https://forgejo.riotpiao.com/rock/kmsvc-manage.git
-    targetRevision: main
+    targetRevision: prod
     path: k8s/argocd/apps
     directory:
       recurse: false
   destination:
     server: https://kubernetes.default.svc
-    namespace: cicd
+    namespace: sqs
   syncPolicy:
     automated:
       prune: true

k8s/charts/management-service/values.yaml

@@ -2,7 +2,7 @@ namespace: sqs
 replicaCount: 2
 
 image:
-  repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service
+  repository: forgejo.riotpiao.com/rock/kmsvc-manage
   tag: latest
   pullPolicy: Always