feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/security/iam/vault-values.yaml

@@ -9,7 +9,7 @@
 # once after first install to initialize and store the keys).
 
 # ── Global ────────────────────────────────────────────────────────────────────
-# tlsDisable: true — TLS terminated at the nginx ingress (vault.riotpiao.homelab.com)
+# tlsDisable: true — TLS terminated at the nginx ingress (vault.riotpiao.com)
 # or at port-forward. In-cluster traffic to Vault is plain HTTP; this is acceptable
 # because all clients are on the pod network (not crossing node boundaries).
 global:
@@ -137,7 +137,7 @@ server:
 
   # ── Service ─────────────────────────────────────────────────────────────────
   # NodePort 32171 — fallback for direct node access during bootstrap before
-  # the ingress is up. Normal access is via nginx ingress (vault.riotpiao.homelab.com).
+  # the ingress is up. Normal access is via nginx ingress (vault.riotpiao.com).
   service:
     type: NodePort
     port: 8200
@@ -155,7 +155,7 @@ server:
 # ── UI ────────────────────────────────────────────────────────────────────────
 # Vault's web UI is used for the OIDC browser login flow (Vault as an OIDC
 # provider, if configured) and for manual operator inspection.
-# Accessible at http://vault.riotpiao.homelab.com or via port-forward.
+# Accessible at http://vault.riotpiao.com or via port-forward.
 ui:
   enabled: true