feat(monitoring): enable Alertmanager (null receiver, longhorn PVC, az-a) + fix forgejo-rules ns forgejo->cicd — alerting delivery was disabled; forgejo PrometheusRule targeted a nonexistent namespace

terraform/files/cilium/l2-announcement.yaml

@@ -0,0 +1,13 @@
+# CiliumL2AnnouncementPolicy — ARPs each LoadBalancer IP (from lb-ippool) on the
+# LAN so the EXTERNAL-IP is actually reachable. Without it, LB-IPAM assigns IPs
+# but nothing answers ARP (100% packet loss / incomplete ARP). One node per IP
+# holds the lease (leaderElection) to avoid ARP flapping. Requires kube-proxy
+# replacement (enabled) and Cilium L2 announcements (default since v1.14).
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: homelab-l2-announce
+spec:
+  loadBalancerIPs: true
+  interfaces:
+    - eno1

terraform/files/cilium/lb-ippool.yaml

@@ -0,0 +1,15 @@
+# CiliumLoadBalancerIPPool — the IPs Cilium LB-IPAM may assign to LoadBalancer
+# Services. CIDR 192.168.1.160/28 covers .160–.175 on the LAN.
+#   .160  ingress-nginx (LoadBalancer)
+#   .161  forgejo-ssh   (LoadBalancer)
+#   .162–.175  free
+# Do NOT add a 10.6.0.0/24 block — that is the WireGuard subnet; letting LB-IPAM
+# hand out a CP tunnel IP breaks the tunnel, and L2 ARP only works on the LAN
+# interface (eno1) anyway. Keep this pool LAN-only.
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: homelab-pool
+spec:
+  blocks:
+    - cidr: "192.168.1.160/28"