feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/bootstrap/ingress/nginx-values.yaml

@@ -1,16 +1,16 @@
 # k8s/ingress/nginx-values.yaml
 # Nginx Ingress Controller — bare-metal homelab config.
 # LoadBalancer service with Cilium LB-IPAM assigns fixed IP (192.168.1.160).
-# Access services at https://grafana.riotpiao.homelab.com (80/443 via LoadBalancer).
+# Access services at https://grafana.riotpiao.com (80/443 via LoadBalancer).
 
 controller:
   kind: DaemonSet
 
-  # Single wildcard cert served for every *.riotpiao.homelab.com host.
-  # Applied by the ingress-nginx presync hook (wildcard-cert.yaml) before nginx starts.
-  # nginx hot-reloads when cert-manager renews homelab-tls — no restart needed.
+  # Single wildcard cert served for every *.riotpiao.com host (Let's Encrypt,
+  # see ../ingress/riotpiao-com-cert.yaml + ../cert-manager/letsencrypt-issuer.yaml).
+  # nginx hot-reloads when cert-manager renews riotpiao-com-tls — no restart needed.
   extraArgs:
-    default-ssl-certificate: "ingress-nginx/homelab-tls"
+    default-ssl-certificate: "ingress-nginx/riotpiao-com-tls"
 
   hostPort:
     enabled: true
@@ -19,7 +19,7 @@ controller:
       https: 443
 
   # TCP proxy: forward port 2222 on every node → Forgejo SSH service.
-  # This lets `git clone [email protected].homelab.com:repo` work via the
+  # This lets `git clone [email protected]:repo` work via the
   # same hostname as HTTPS without a separate LoadBalancer IP for SSH.
   tcp:
     2222: "cicd/forgejo-gitea-ssh:2222"