feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/bootstrap/ingress/ingress.yaml

@@ -1,10 +1,10 @@
 # k8s/ingress/ingress.yaml
 # Ingress rules for all homelab services.
-# TLS is handled centrally: nginx serves the wildcard-tls cert (*.riotpiao.homelab.com)
+# TLS is handled centrally: nginx serves the wildcard-tls cert (*.riotpiao.com)
 # as its default-ssl-certificate. No per-rule tls: blocks or cert-manager annotations
 # are needed — cert-manager manages one cert, nginx uses it for all hosts.
 #
-# DNS: *.riotpiao.homelab.com must resolve to 10.6.0.1 (WireGuard) or 192.168.1.160 (LAN).
+# DNS: *.riotpiao.com must resolve to 10.6.0.1 (WireGuard) or 192.168.1.160 (LAN).
 
 # ── Grafana ───────────────────────────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
@@ -17,7 +17,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: grafana.riotpiao.homelab.com
+    - host: grafana.riotpiao.com
       http:
         paths:
           - path: /
@@ -38,7 +38,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: loki.riotpiao.homelab.com
+    - host: loki.riotpiao.com
       http:
         paths:
           - path: /
@@ -62,7 +62,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: authentik.riotpiao.homelab.com
+    - host: authentik.riotpiao.com
       http:
         paths:
           - path: /
@@ -85,7 +85,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: vault.riotpiao.homelab.com
+    - host: vault.riotpiao.com
       http:
         paths:
           - path: /
@@ -113,7 +113,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: minio.riotpiao.homelab.com
+    - host: minio.riotpiao.com
       http:
         paths:
           - path: /
@@ -138,7 +138,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: minio-api.riotpiao.homelab.com
+    - host: minio-api.riotpiao.com
       http:
         paths:
           - path: /
@@ -159,7 +159,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: prometheus.riotpiao.homelab.com
+    - host: prometheus.riotpiao.com
       http:
         paths:
           - path: /
@@ -183,7 +183,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: portainer.riotpiao.homelab.com
+    - host: portainer.riotpiao.com
       http:
         paths:
           - path: /
@@ -210,7 +210,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: forgejo.riotpiao.homelab.com
+    - host: forgejo.riotpiao.com
       http:
         paths:
           - path: /
@@ -238,7 +238,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: argocd.riotpiao.homelab.com
+    - host: argocd.riotpiao.com
       http:
         paths:
           - path: /
@@ -259,7 +259,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: longhorn.riotpiao.homelab.com
+    - host: longhorn.riotpiao.com
       http:
         paths:
           - path: /
@@ -285,7 +285,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: temporal.riotpiao.homelab.com
+    - host: temporal.riotpiao.com
       http:
         paths:
           - path: /
@@ -307,7 +307,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: kmsvc.riotpiao.homelab.com
+    - host: kmsvc.riotpiao.com
       http:
         paths:
           - path: /

k8s/bootstrap/ingress/nginx-values.yaml

@@ -1,16 +1,16 @@
 # k8s/ingress/nginx-values.yaml
 # Nginx Ingress Controller — bare-metal homelab config.
 # LoadBalancer service with Cilium LB-IPAM assigns fixed IP (192.168.1.160).
-# Access services at https://grafana.riotpiao.homelab.com (80/443 via LoadBalancer).
+# Access services at https://grafana.riotpiao.com (80/443 via LoadBalancer).
 
 controller:
   kind: DaemonSet
 
-  # Single wildcard cert served for every *.riotpiao.homelab.com host.
-  # Applied by the ingress-nginx presync hook (wildcard-cert.yaml) before nginx starts.
-  # nginx hot-reloads when cert-manager renews homelab-tls — no restart needed.
+  # Single wildcard cert served for every *.riotpiao.com host (Let's Encrypt,
+  # see ../ingress/riotpiao-com-cert.yaml + ../cert-manager/letsencrypt-issuer.yaml).
+  # nginx hot-reloads when cert-manager renews riotpiao-com-tls — no restart needed.
   extraArgs:
-    default-ssl-certificate: "ingress-nginx/homelab-tls"
+    default-ssl-certificate: "ingress-nginx/riotpiao-com-tls"
 
   hostPort:
     enabled: true
@@ -19,7 +19,7 @@ controller:
       https: 443
 
   # TCP proxy: forward port 2222 on every node → Forgejo SSH service.
-  # This lets `git clone [email protected].homelab.com:repo` work via the
+  # This lets `git clone [email protected]:repo` work via the
   # same hostname as HTTPS without a separate LoadBalancer IP for SSH.
   tcp:
     2222: "cicd/forgejo-gitea-ssh:2222"

k8s/bootstrap/ingress/riotpiao-com-cert.yaml

@@ -0,0 +1,25 @@
+# k8s/bootstrap/ingress/riotpiao-com-cert.yaml
+# Public wildcard cert for *.riotpiao.com, signed by Let's Encrypt (DNS-01 via
+# Cloudflare, see ../cert-manager/letsencrypt-issuer.yaml). Distinct from
+# homelab-tls (self-signed homelab-ca, internal *.riotpiao.com) —
+# reference riotpiao-com-tls explicitly on ingresses that expose riotpiao.com
+# hosts to the internet; it is not nginx's default-ssl-certificate.
+#
+# issuerRef starts on letsencrypt-staging. Switch to letsencrypt-prod once the
+# staging cert issues cleanly, then delete this Certificate's Secret to force
+# a re-issue against prod (staging certs aren't browser-trusted).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: riotpiao-com-tls
+  namespace: ingress-nginx
+spec:
+  secretName: riotpiao-com-tls
+  dnsNames:
+    - "*.riotpiao.com"
+    - "riotpiao.com"
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  duration: 2160h     # 90 days (LE max)
+  renewBefore: 720h   # renew 30 days before expiry

k8s/bootstrap/ingress/wildcard-cert.yaml

@@ -1,22 +0,0 @@
-# k8s/ingress/wildcard-cert.yaml
-# Single wildcard TLS certificate for all *.riotpiao.homelab.com services.
-# Lives in the ingress-nginx namespace and is set as nginx's default-ssl-certificate,
-# so every ingress host gets it automatically — no per-service TLS blocks needed.
-#
-# Renewal: cert-manager auto-renews 30 days before expiry (renewBefore: 720h).
-# nginx detects the secret update via its K8s watch and hot-reloads — no pod restart.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: homelab-tls
-  namespace: ingress-nginx
-spec:
-  secretName: homelab-tls
-  dnsNames:
-    - "*.riotpiao.homelab.com"
-    - "riotpiao.homelab.com"
-  issuerRef:
-    name: homelab-ca
-    kind: ClusterIssuer
-  duration: 8760h      # 1 year
-  renewBefore: 720h    # renew 30 days before expiry