feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/security/ci-cd/argocd-values.yaml

@@ -3,7 +3,7 @@
 # Deployed via helmfile (name=argocd) so it sits alongside Authentik, MinIO, etc.
 #
 # UI is exposed via the cluster Ingress (k8s/ingress/ingress.yaml,
-# argocd.riotpiao.homelab.com) over the WireGuard/LAN-only nginx ingress —
+# argocd.riotpiao.com) over the WireGuard/LAN-only nginx ingress —
 # never as a LoadBalancer, since argocd-server holds cluster-admin
 # credentials and that Ingress isn't reachable from the WAN.
 #
@@ -12,7 +12,7 @@
 # CA trust for Forgejo repo clones injected into argocd-tls-certs-cm by postsync hook.
 
 global:
-  domain: argocd.riotpiao.homelab.com
+  domain: argocd.riotpiao.com
 
 configs:
   params:
@@ -23,10 +23,10 @@ configs:
     # Authentik (provision_oidc.py argocd_url) exactly — ArgoCD builds its
     # OIDC redirect_uri as "{url}/auth/callback", so any mismatch here is
     # what Authentik's "Invalid redirect URL" error means.
-    url: "https://argocd.riotpiao.homelab.com"
+    url: "https://argocd.riotpiao.com"
     oidc.config: |
       name: Authentik
-      issuer: https://authentik.riotpiao.homelab.com/application/o/argocd/
+      issuer: https://authentik.riotpiao.com/application/o/argocd/
       clientID: $oidc-secret:client-id
       clientSecret: $oidc-secret:client-secret
       requestedScopes: [openid, profile, email, groups]