feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/security/iam/README.md

@@ -227,7 +227,7 @@ The homelab provides **automated OAuth registration** for new services via `regi
 python3 k8s/talos-iam/register_oauth_app.py \
   --service-name my-service \
   --namespace my-ns \
-  --redirect-uri "https://my-service.riotpiao.homelab.com/oauth2/callback" \
+  --redirect-uri "https://my-service.riotpiao.com/oauth2/callback" \
   --service-name-in-vault MY_SERVICE \
   --vault-jwt-policy shell-secrets \
   --add-group my-service-admins
@@ -254,7 +254,7 @@ export DASHBOARD_OIDC_CLIENT_SECRET
 python3 k8s/talos-iam/register_oauth_app.py \
   --service-name dashboard-service \
   --namespace apps \
-  --redirect-uri "https://dashboard.riotpiao.homelab.com/oauth2/callback" \
+  --redirect-uri "https://dashboard.riotpiao.com/oauth2/callback" \
   --service-name-in-vault DASHBOARD \
   --vault-jwt-policy shell-secrets \
   --add-group dashboard-admins \
@@ -282,7 +282,7 @@ kubectl get secret my-service-oidc -n my-ns -o yaml
 vault read auth/jwt/role/my-service
 
 # Test OAuth login
-# Browser: https://my-service.riotpiao.homelab.com/login
+# Browser: https://my-service.riotpiao.com/login
 # Should redirect to Authentik → back to service with session
 ```