feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/platform/logging/grafana-values.yaml

@@ -39,7 +39,7 @@ persistence:
 # ── Grafana config ────────────────────────────────────────────────────────────
 grafana.ini:
   server:
-    root_url: https://grafana.riotpiao.homelab.com
+    root_url: https://grafana.riotpiao.com
 
   # No anonymous read access — every user must log in via Authentik SSO.
   auth.anonymous:
@@ -70,9 +70,9 @@ grafana.ini:
     allow_sign_up: true
     client_id: grafana
     scopes: openid email profile
-    auth_url: https://authentik.riotpiao.homelab.com/application/o/authorize/
-    token_url: https://authentik.riotpiao.homelab.com/application/o/token/
-    api_url: https://authentik.riotpiao.homelab.com/application/o/userinfo/
+    auth_url: https://authentik.riotpiao.com/application/o/authorize/
+    token_url: https://authentik.riotpiao.com/application/o/token/
+    api_url: https://authentik.riotpiao.com/application/o/userinfo/
     role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
     use_pkce: false
     use_refresh_token: false
@@ -154,7 +154,7 @@ tolerations:
     operator: Exists
     effect: NoSchedule
 
-# ClusterIP only — access via ingress (grafana.riotpiao.homelab.com) or port-forward.
+# ClusterIP only — access via ingress (grafana.riotpiao.com) or port-forward.
 service:
   type: ClusterIP
   port: 80