feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/applications/forge/runner.yaml

@@ -21,7 +21,7 @@
 #   The homelab-ca secret above only reaches the runner/register/dind containers.
 #   It does NOT reach the per-job containers DinD spawns (e.g. golangci-lint,
 #   node:22-bookworm) — those are fresh sibling containers with their own trust
-#   store. Without this, any git/curl/apk call to forgejo.riotpiao.homelab.com
+#   store. Without this, any git/curl/apk call to forgejo.riotpiao.com
 #   from inside a job fails with "SSL certificate problem: unable to get local
 #   issuer certificate". Build a merged bundle (public roots + homelab CA) and
 #   bind-mount it over /etc/ssl/certs/ca-certificates.crt in every job
@@ -30,7 +30,7 @@
 #   IMPORTANT: source the CA from the live cluster secret, NOT from
 #   k8s/forge/pki/ca.crt — that repo file is a stale CA from before the
 #   "unified certificate" migration (different key, fails verification
-#   against the cert actually served by forgejo.riotpiao.homelab.com). The
+#   against the cert actually served by forgejo.riotpiao.com). The
 #   org-wide CA that signs the live ingress cert lives in
 #   cert-manager/homelab-ca-secret, and cicd/homelab-ca above is already
 #   synced from it.
@@ -220,7 +220,7 @@ spec:
             - |
               test -f /data/.runner && echo "already registered, skipping" && exit 0
               forgejo-runner register --no-interactive \
-                --instance https://forgejo.riotpiao.homelab.com \
+                --instance https://forgejo.riotpiao.com \
                 --token "$RUNNER_TOKEN" \
                 --name talos-runner \
                 --labels "docker:docker://node:22-bookworm"
@@ -407,7 +407,7 @@ spec:
     - to:
         - podSelector: {}
     # ingress-nginx (the runner talks to Forgejo via its public hostname,
-    # https://forgejo.riotpiao.homelab.com, which resolves to the ingress
+    # https://forgejo.riotpiao.com, which resolves to the ingress
     # controller's ClusterIP — a different namespace on the pod network)
     - to:
         - namespaceSelector: