feat(monitoring): enable Alertmanager (null receiver, longhorn PVC, az-a) + fix forgejo-rules ns forgejo->cicd — alerting delivery was disabled; forgejo PrometheusRule targeted a nonexistent namespace

terraform/templates/controlplane.tftpl

@@ -164,6 +164,18 @@ cluster:
         kind: Namespace
         metadata:
           name: kube-system
+    # Cilium LoadBalancer IPAM pool + L2 announcement policy. Substrate networking
+    # (owned here alongside the Cilium install), single source of truth in
+    # terraform/files/cilium/*.yaml. Provides LAN LoadBalancer IPs for ingress-nginx
+    # (.160) and forgejo-ssh (.161). Was previously an ArgoCD app whose empty
+    # kustomization never actually applied it (the live pool came from manual
+    # kubectl); moved here so LB-IPAM exists before any LoadBalancer Service syncs.
+    - name: cilium-lb-ippool
+      contents: |
+${indent(8, cilium_lb_ippool)}
+    - name: cilium-l2-announcement
+      contents: |
+${indent(8, cilium_l2_announcement)}
     # CoreDNS Corefile with homelab hostname rewrites (single source of truth in
     # terraform/files/coredns/Corefile). In-cluster pods resolve *.riotpiao.com to
     # the nginx ingress controller so OIDC auto-discovery against

terraform/templates/worker.tftpl

@@ -71,11 +71,20 @@ machine:
   nodeLabels:
     topology.kubernetes.io/region: homelab
     topology.kubernetes.io/zone: ${zone}
-    node-role.kubernetes.io/gpu-node: ""
 %{ if gpu_count > 0 ~}
+    node-role.kubernetes.io/gpu-node: ""
     nvidia.com/gpu: "true"
     gpu-count: "${gpu_count}"
 %{ endif ~}
+%{ for k, v in node_labels ~}
+    ${k}: "${v}"
+%{ endfor ~}
+%{ if length(node_taints) > 0 ~}
+  nodeTaints:
+%{ for t in node_taints ~}
+    ${t.key}: "${t.value}:${t.effect}"
+%{ endfor ~}
+%{ endif ~}
 
 cluster:
   id: ${cluster_id}