feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/bootstrap/ingress/ingress.yaml

@@ -1,10 +1,10 @@
 # k8s/ingress/ingress.yaml
 # Ingress rules for all homelab services.
-# TLS is handled centrally: nginx serves the wildcard-tls cert (*.riotpiao.homelab.com)
+# TLS is handled centrally: nginx serves the wildcard-tls cert (*.riotpiao.com)
 # as its default-ssl-certificate. No per-rule tls: blocks or cert-manager annotations
 # are needed — cert-manager manages one cert, nginx uses it for all hosts.
 #
-# DNS: *.riotpiao.homelab.com must resolve to 10.6.0.1 (WireGuard) or 192.168.1.160 (LAN).
+# DNS: *.riotpiao.com must resolve to 10.6.0.1 (WireGuard) or 192.168.1.160 (LAN).
 
 # ── Grafana ───────────────────────────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
@@ -17,7 +17,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: grafana.riotpiao.homelab.com
+    - host: grafana.riotpiao.com
       http:
         paths:
           - path: /
@@ -38,7 +38,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: loki.riotpiao.homelab.com
+    - host: loki.riotpiao.com
       http:
         paths:
           - path: /
@@ -62,7 +62,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: authentik.riotpiao.homelab.com
+    - host: authentik.riotpiao.com
       http:
         paths:
           - path: /
@@ -85,7 +85,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: vault.riotpiao.homelab.com
+    - host: vault.riotpiao.com
       http:
         paths:
           - path: /
@@ -113,7 +113,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: minio.riotpiao.homelab.com
+    - host: minio.riotpiao.com
       http:
         paths:
           - path: /
@@ -138,7 +138,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: minio-api.riotpiao.homelab.com
+    - host: minio-api.riotpiao.com
       http:
         paths:
           - path: /
@@ -159,7 +159,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: prometheus.riotpiao.homelab.com
+    - host: prometheus.riotpiao.com
       http:
         paths:
           - path: /
@@ -183,7 +183,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: portainer.riotpiao.homelab.com
+    - host: portainer.riotpiao.com
       http:
         paths:
           - path: /
@@ -210,7 +210,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: forgejo.riotpiao.homelab.com
+    - host: forgejo.riotpiao.com
       http:
         paths:
           - path: /
@@ -238,7 +238,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: argocd.riotpiao.homelab.com
+    - host: argocd.riotpiao.com
       http:
         paths:
           - path: /
@@ -259,7 +259,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: longhorn.riotpiao.homelab.com
+    - host: longhorn.riotpiao.com
       http:
         paths:
           - path: /
@@ -285,7 +285,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: temporal.riotpiao.homelab.com
+    - host: temporal.riotpiao.com
       http:
         paths:
           - path: /
@@ -307,7 +307,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: kmsvc.riotpiao.homelab.com
+    - host: kmsvc.riotpiao.com
       http:
         paths:
           - path: /