feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

project-usage/networking-ingress.md

@@ -27,10 +27,10 @@ spec:
   ingressClassName: nginx
   tls:
   - hosts:
-    - myapp.riotpiao.homelab.com
+    - myapp.riotpiao.com
     secretName: myapp-tls
   rules:
-  - host: myapp.riotpiao.homelab.com
+  - host: myapp.riotpiao.com
     http:
       paths:
       - path: /
@@ -54,10 +54,10 @@ kubectl get certificate -n myapp-ns
 **3. Test from client:**
 ```bash
 # Add to /etc/hosts (or use WireGuard)
-192.168.1.160 myapp.riotpiao.homelab.com
+192.168.1.160 myapp.riotpiao.com
 
 # Access
-curl https://myapp.riotpiao.homelab.com
+curl https://myapp.riotpiao.com
 ```
 
 ## Configuration
@@ -83,10 +83,10 @@ spec:
   ingressClassName: nginx
   tls:
   - hosts:
-    - api.riotpiao.homelab.com
+    - api.riotpiao.com
     secretName: api-tls
   rules:
-  - host: api.riotpiao.homelab.com
+  - host: api.riotpiao.com
     http:
       paths:
       - path: /users
@@ -130,7 +130,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: protected.riotpiao.homelab.com
+  - host: protected.riotpiao.com
     http:
       paths:
       - path: /
@@ -146,8 +146,8 @@ spec:
 ```yaml
 # k8s/coredns/coredns-configmap.yaml
 # Rewrite:
-# - grafana.riotpiao.homelab.com → grafana.logging (cluster-internal)
-# - prometheus.riotpiao.homelab.com → prometheus-kube-prom-prometheus.monitoring
+# - grafana.riotpiao.com → grafana.logging (cluster-internal)
+# - prometheus.riotpiao.com → prometheus-kube-prom-prometheus.monitoring
 #
 # Allows pods to use external URLs but resolve to internal Services
 ```
@@ -184,9 +184,9 @@ spec:
   secretName: myapp-tls
   duration: 2160h  # 90 days
   renewBefore: 360h  # renew 15 days before expiry
-  commonName: myapp.riotpiao.homelab.com
+  commonName: myapp.riotpiao.com
   dnsNames:
-  - myapp.riotpiao.homelab.com
+  - myapp.riotpiao.com
   issuerRef:
     name: homelab-ca
     kind: ClusterIssuer
@@ -229,7 +229,7 @@ nslookup grafana                             # if in logging namespace
 make pf-grafana  # localhost:3000 → grafana.logging:3000
 
 # Option 3: Add to /etc/hosts (on home network)
-192.168.1.160 grafana.riotpiao.homelab.com
+192.168.1.160 grafana.riotpiao.com
 ```
 
 ## Monitoring
@@ -308,7 +308,7 @@ k get secret -n myapp-ns myapp-tls -o jsonpath='{.data.tls\.crt}' | base64 -d |
 
 # If cert is self-signed (homelab-ca), add to client's trusted roots
 # Or bypass cert verification (dev only):
-curl -k https://myapp.riotpiao.homelab.com
+curl -k https://myapp.riotpiao.com
 ```
 
 See `/TROUBLESHOOTING.md` for full incident guide.