feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

project-usage/infra-practice.md

@@ -107,7 +107,7 @@ Standardized procedures for troubleshooting, developing, deploying, and operatin
    - Verify scrape: `kubectl get servicemonitor -A | grep <name>` and check Prometheus Targets UI for green status.
 
 9. **If OIDC/IAM-gated (admin UI, restricted API):**
-   - Create app in Authentik: `core iam create-app "my-service" --slug my-service --redirect-uri "https://my-service.riotpiao.homelab.com/callback"`.
+   - Create app in Authentik: `core iam create-app "my-service" --slug my-service --redirect-uri "https://my-service.riotpiao.com/callback"`.
    - Bind app to group: `core iam bind-app my-service <group>` (e.g., `grafana-admins` for admin-only UI).
    - Retrieve credentials: `core iam describe-app my-service` (client ID, client secret).
    - Deploy secret: `kubectl create secret generic <service>-oidc --from-literal=client-id=<ID> --from-literal=client-secret=<SECRET> -n <namespace>`.
@@ -117,7 +117,7 @@ Standardized procedures for troubleshooting, developing, deploying, and operatin
 10. **Verify service is live.**
     - Pods: `kubectl get pods -n <namespace> -o wide` (all Running, 1/1 Ready).
     - Metrics (if applicable): `kubectl get servicemonitor -A | grep <name>` and visit Prometheus Targets or Grafana dashboard.
-    - Endpoint: If publicly routed via Ingress, verify `/etc/hosts` entry (10.6.0.1 for WireGuard, 192.168.1.160 for LAN) and `curl https://my-service.riotpiao.homelab.com/health` (or equivalent health endpoint).
+    - Endpoint: If publicly routed via Ingress, verify `/etc/hosts` entry (10.6.0.1 for WireGuard, 192.168.1.160 for LAN) and `curl https://my-service.riotpiao.com/health` (or equivalent health endpoint).
     - Logs: `kubectl logs -n <namespace> <pod>` (no errors).
 
 ### Definition of Done (Per Service)