Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

k8s/coredns/coredns-configmap.yaml

@@ -30,8 +30,13 @@ data:
         }
         prometheus :9153
 
-        # Forgejo: route to HTTP service (LoadBalancer handles both HTTPS:443 + SSH:2222 via same IP)
-        rewrite name forgejo.riotpiao.homelab.com forgejo-gitea-http.cicd.svc.cluster.local
+        # Forgejo: route through nginx ingress like every other host below. nginx
+        # terminates TLS (wildcard-tls) on :443 and routes both /v2/ (container
+        # registry) and web/git to forgejo-gitea-http:3000.
+        # Do NOT point this at forgejo-gitea-http directly: that service only serves
+        # port 3000, so containerd image pulls (which use https/:443) get
+        # `dial tcp <clusterIP>:443: i/o timeout`. SSH stays on its own LB service.
+        rewrite name forgejo.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
         # Rewrite homelab hostnames to the nginx ingress controller so in-cluster pods
         # hit nginx TLS termination (cert-manager cert) and preserve the Host header.