feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/platform/logging/grafana-values.yaml

@@ -39,7 +39,7 @@ persistence:
 # ── Grafana config ────────────────────────────────────────────────────────────
 grafana.ini:
   server:
-    root_url: https://grafana.riotpiao.homelab.com
+    root_url: https://grafana.riotpiao.com
 
   # No anonymous read access — every user must log in via Authentik SSO.
   auth.anonymous:
@@ -70,9 +70,9 @@ grafana.ini:
     allow_sign_up: true
     client_id: grafana
     scopes: openid email profile
-    auth_url: https://authentik.riotpiao.homelab.com/application/o/authorize/
-    token_url: https://authentik.riotpiao.homelab.com/application/o/token/
-    api_url: https://authentik.riotpiao.homelab.com/application/o/userinfo/
+    auth_url: https://authentik.riotpiao.com/application/o/authorize/
+    token_url: https://authentik.riotpiao.com/application/o/token/
+    api_url: https://authentik.riotpiao.com/application/o/userinfo/
     role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
     use_pkce: false
     use_refresh_token: false
@@ -154,7 +154,7 @@ tolerations:
     operator: Exists
     effect: NoSchedule
 
-# ClusterIP only — access via ingress (grafana.riotpiao.homelab.com) or port-forward.
+# ClusterIP only — access via ingress (grafana.riotpiao.com) or port-forward.
 service:
   type: ClusterIP
   port: 80

k8s/platform/monitoring/blackbox-exporter-values.yaml

@@ -40,27 +40,27 @@ serviceMonitor:
     module: http_2xx
   targets:
     - name: grafana
-      url: https://grafana.riotpiao.homelab.com/
+      url: https://grafana.riotpiao.com/
     - name: loki
-      url: https://loki.riotpiao.homelab.com/ready
+      url: https://loki.riotpiao.com/ready
     - name: authentik
-      url: https://authentik.riotpiao.homelab.com/-/health/ready/
+      url: https://authentik.riotpiao.com/-/health/ready/
     - name: vault
-      url: https://vault.riotpiao.homelab.com/v1/sys/health
+      url: https://vault.riotpiao.com/v1/sys/health
     - name: minio-console
-      url: https://minio.riotpiao.homelab.com/
+      url: https://minio.riotpiao.com/
     - name: minio-api
-      url: https://minio-api.riotpiao.homelab.com/minio/health/live
+      url: https://minio-api.riotpiao.com/minio/health/live
     - name: prometheus
-      url: https://prometheus.riotpiao.homelab.com/-/healthy
+      url: https://prometheus.riotpiao.com/-/healthy
     - name: portainer
-      url: https://portainer.riotpiao.homelab.com/
+      url: https://portainer.riotpiao.com/
     - name: forgejo
-      url: https://forgejo.riotpiao.homelab.com/api/healthz
+      url: https://forgejo.riotpiao.com/api/healthz
     - name: argocd
-      url: https://argocd.riotpiao.homelab.com/healthz
+      url: https://argocd.riotpiao.com/healthz
     - name: longhorn
-      url: https://longhorn.riotpiao.homelab.com/
+      url: https://longhorn.riotpiao.com/
 
 prometheusRule:
   enabled: true