feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

2026-07-19 09:29:17 -07:00
parent c6493f14ae
commit 578a707867
86 changed files with 889 additions and 446 deletions
@@ -0,0 +1,25 @@
+# k8s/bootstrap/ingress/riotpiao-com-cert.yaml
+# Public wildcard cert for *.riotpiao.com, signed by Let's Encrypt (DNS-01 via
+# Cloudflare, see ../cert-manager/letsencrypt-issuer.yaml). Distinct from
+# homelab-tls (self-signed homelab-ca, internal *.riotpiao.com) —
+# reference riotpiao-com-tls explicitly on ingresses that expose riotpiao.com
+# hosts to the internet; it is not nginx's default-ssl-certificate.
+#
+# issuerRef starts on letsencrypt-staging. Switch to letsencrypt-prod once the
+# staging cert issues cleanly, then delete this Certificate's Secret to force
+# a re-issue against prod (staging certs aren't browser-trusted).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: riotpiao-com-tls
+  namespace: ingress-nginx
+spec:
+  secretName: riotpiao-com-tls
+  dnsNames:
+    - "*.riotpiao.com"
+    - "riotpiao.com"
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  duration: 2160h     # 90 days (LE max)
+  renewBefore: 720h   # renew 30 days before expiry