feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/bootstrap/cert-manager/letsencrypt-issuer.yaml

@@ -0,0 +1,45 @@
+# k8s/bootstrap/cert-manager/letsencrypt-issuer.yaml
+# Let's Encrypt ClusterIssuers for *.riotpiao.com, DNS-01 via Cloudflare
+# (wildcard certs require DNS-01 — HTTP-01 can't prove ownership of a wildcard name).
+#
+# Prereq (apply manually, not in git — token is a secret):
+#   kubectl create secret generic cloudflare-api-token-secret \
+#     --namespace cert-manager \
+#     --from-literal=api-token=<CLOUDFLARE_API_TOKEN>
+# Token scope: Zone:DNS:Edit for the riotpiao.com zone.
+#
+# Start with letsencrypt-staging to validate the solver, then point
+# Certificate.issuerRef at letsencrypt-prod once staging issues cleanly.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token-secret
+              key: api-token
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token-secret
+              key: api-token