feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/security/iam/register_oauth_app.py

@@ -10,7 +10,7 @@ Usage:
   python3 register_oauth_app.py \\
     --service-name my-service \\
     --namespace my-ns \\
-    --redirect-uri "https://my-service.riotpiao.homelab.com/oauth2/callback" \\
+    --redirect-uri "https://my-service.riotpiao.com/oauth2/callback" \\
     [--service-name-in-vault MY_SERVICE] \\
     [--vault-jwt-policy shell-secrets]
 
@@ -28,13 +28,13 @@ Examples:
   python3 register_oauth_app.py \\
     --service-name myapp \\
     --namespace apps \\
-    --redirect-uri "https://myapp.riotpiao.homelab.com/callback"
+    --redirect-uri "https://myapp.riotpiao.com/callback"
 
   # Advanced: full service with Vault JWT auth
   python3 register_oauth_app.py \\
     --service-name myservice \\
     --namespace my-namespace \\
-    --redirect-uri "https://myservice.riotpiao.homelab.com/oauth2/callback" \\
+    --redirect-uri "https://myservice.riotpiao.com/oauth2/callback" \\
     --service-name-in-vault MYSERVICE \\
     --vault-jwt-policy shell-secrets \\
     --add-group myservice-admins \\
@@ -328,7 +328,7 @@ def main() -> None:
     parser.add_argument(
         "--redirect-uri",
         required=True,
-        help="OAuth2 redirect URI (e.g., https://myapp.riotpiao.homelab.com/callback)"
+        help="OAuth2 redirect URI (e.g., https://myapp.riotpiao.com/callback)"
     )
     parser.add_argument(
         "--service-name-in-vault",
@@ -420,7 +420,7 @@ def main() -> None:
         display_name=service_name.replace("-", " ").title(),
         slug=service_name,
         provider_pk=provider_pk,
-        launch_url=f"https://{service_name}.riotpiao.homelab.com"
+        launch_url=f"https://{service_name}.riotpiao.com"
     )
     print()