feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs

k8s/argocd/bootstrap/cnpg-operator.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cnpg-operator
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  source:
+    repoURL: https://cloudnative-pg.github.io/charts
+    chart: cloudnative-pg
+    targetRevision: "*"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ddb
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

k8s/argocd/bootstrap/forgejo.yaml

@@ -0,0 +1,146 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "7"
+    # Must sync after cnpg-operator (wave 0) and the ddb-cluster/forgejo-database
+    # (wave 6, k8s/data) — Forgejo's DB connection depends on both existing first.
+spec:
+  project: homelab
+  source:
+    repoURL: https://dl.gitea.com/charts/
+    chart: gitea
+    targetRevision: "~10"
+    helm:
+      # Mirrors k8s/security/ci-cd/forgejo-values.yaml inline — avoids the
+      # git-repo chicken-egg (Forgejo can't source its own values from a repo
+      # it hosts). Keep both files in sync when editing either one.
+      valuesObject:
+        image:
+          repository: codeberg.org/forgejo/forgejo
+          tag: "13"
+          pullPolicy: IfNotPresent
+        gitea:
+          admin:
+            username: rock
+            email: [email protected]
+          config:
+            server:
+              PROTOCOL: http
+              DOMAIN: forgejo.riotpiao.com
+              ROOT_URL: https://forgejo.riotpiao.com/
+              HTTP_PORT: 3000
+              START_SSH_SERVER: true
+              SSH_DOMAIN: forgejo.riotpiao.com
+              SSH_PORT: 2222
+              SSH_LISTEN_PORT: 2222
+            database:
+              DB_TYPE: postgres
+              HOST: ddb-cluster-rw.ddb.svc:5432
+              NAME: forgejo
+              USER: app
+            repository:
+              ROOT: /data/git
+            actions:
+              ENABLED: true
+            packages:
+              ENABLED: true
+            metrics:
+              ENABLED: true
+            service:
+              DISABLE_REGISTRATION: true
+            oauth2:
+              ENABLED: true
+              PROVIDER: openidconnect
+              OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
+              CLIENT_ID: forgejo
+              AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
+            cache:
+              ADAPTER: redis
+              HOST: "redis://forgejo-redis.cicd.svc:6379/0"
+            session:
+              PROVIDER: redis
+              PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
+            queue:
+              TYPE: redis
+              CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
+          metrics:
+            enabled: true
+            serviceMonitor:
+              enabled: false
+        persistence:
+          enabled: true
+          storageClass: longhorn
+          size: 20Gi
+          accessModes:
+            - ReadWriteMany
+        replicaCount: 2
+        deployment:
+          strategy:
+            type: RollingUpdate
+          env:
+            - name: SSL_CERT_DIR
+              value: /homelab-ca
+            - name: GITEA__database__PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: ddb-cluster-app
+                  key: password
+        podAnnotations:
+          configmap.reloader.stakater.com/reload: "homelab-ca"
+        service:
+          http:
+            type: LoadBalancer
+            port: 3000
+            targetPort: 3000
+            annotations:
+              io.cilium/lb-ipam-ips: "192.168.1.165"
+              io.cilium/lb-ipam-sharing-key: "forgejo"
+          ssh:
+            type: LoadBalancer
+            port: 2222
+            targetPort: 2222
+            annotations:
+              io.cilium/lb-ipam-ips: "192.168.1.165"
+              io.cilium/lb-ipam-sharing-key: "forgejo"
+        resources:
+          requests:
+            cpu: 250m
+            memory: 512Mi
+          limits:
+            cpu: "1"
+            memory: 1Gi
+        tolerations:
+          - key: node-role.kubernetes.io/control-plane
+            operator: Exists
+            effect: NoSchedule
+        extraVolumes:
+          - name: homelab-ca
+            configMap:
+              name: homelab-ca
+        extraVolumeMounts:
+          - name: homelab-ca
+            mountPath: /homelab-ca
+            readOnly: true
+        ingress:
+          enabled: false
+        postgresql:
+          enabled: false
+        postgresql-ha:
+          enabled: false
+        mysql:
+          enabled: false
+        redis-cluster:
+          enabled: false
+        act_runner:
+          enabled: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cicd
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    # NO automated sync — Forgejo is what CI uses to push commits; auto-sync
+    # would let a bad CI commit break the system CI depends on. Manual only.