feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/security/iam/OAUTH_APP_SETUP.md

@@ -78,7 +78,7 @@ cd /Users/rockliang/workplace/homelab
 python3 k8s/talos-iam/register_oauth_app.py \
   --service-name my-app \
   --namespace my-namespace \
-  --redirect-uri "https://my-app.riotpiao.homelab.com/oauth2/callback" \
+  --redirect-uri "https://my-app.riotpiao.com/oauth2/callback" \
   --service-name-in-vault "MY_SERVICE" \
   --vault-jwt-policy "shell-secrets"
 ```
@@ -127,7 +127,7 @@ kubectl port-forward -n iam svc/authentik-server 7000:80 &
    - **Name:** `yourservice`
    - **Client ID:** `yourservice` (or custom)
    - **Client Secret:** (paste from `$CLIENT_SECRET` above)
-   - **Redirect URIs:** `https://your-app.riotpiao.homelab.com/oauth2/callback` (or your app's callback URL)
+   - **Redirect URIs:** `https://your-app.riotpiao.com/oauth2/callback` (or your app's callback URL)
    - **Sub Mode:** `Hashed User ID`
    - **Include claims in ID Token:** ✓ Enabled
    - **Grant Types:** `Authorization Code`, `Refresh Token`
@@ -143,7 +143,7 @@ kubectl port-forward -n iam svc/authentik-server 7000:80 &
    - **Name:** `Your App Display Name`
    - **Slug:** `yourservice` (must match provider slug)
    - **Provider:** (select the provider created above)
-   - **Meta Launch URL:** `https://your-app.riotpiao.homelab.com` (optional, for app launcher)
+   - **Meta Launch URL:** `https://your-app.riotpiao.com` (optional, for app launcher)
 
 3. **Save**
 
@@ -160,7 +160,7 @@ OIDC_CLIENT_ID=yourservice
 OIDC_CLIENT_SECRET=$CLIENT_SECRET
 
 # Redirect URI (must match what you configured in step 2)
-OIDC_REDIRECT_URI=https://your-app.riotpiao.homelab.com/oauth2/callback
+OIDC_REDIRECT_URI=https://your-app.riotpiao.com/oauth2/callback
 
 # Optionally, token validation endpoint
 OIDC_TOKEN_URL=http://authentik-server.iam.svc.cluster.local/application/o/yourservice/token/
@@ -179,7 +179,7 @@ talos put cluster/YOURSERVICE_OIDC_CLIENT_SECRET YOURSERVICE_OIDC_CLIENT_SECRET=
 talos put cluster/yourservice-oidc \
   client_id=yourservice \
   issuer_url="http://authentik-server.iam.svc.cluster.local/application/o/yourservice/" \
-  callback_uri="https://your-app.riotpiao.homelab.com/oauth2/callback"
+  callback_uri="https://your-app.riotpiao.com/oauth2/callback"
 ```
 
 ### Step 5: Mount Credentials in Your Service
@@ -378,7 +378,7 @@ kubectl get secret yourservice-oidc -n your-namespace -o jsonpath='{.data}' | ba
 vault read auth/jwt/role/yourservice
 
 # 5. Test OAuth login (requires port-forward to your app)
-# Open http://your-app.riotpiao.homelab.com/login
+# Open http://your-app.riotpiao.com/login
 # Should redirect to Authentik, then back to your app
 
 # 6. Test JWT auth to Vault (if applicable)