k8s/services: add ingress networking portainer llm and project guides

- Nginx ingress + TLS termination (homelab-ca)
- Portainer container UI
- CoreDNS internal DNS rewrites
- DuckDNS DDNS updater
- Ollama LLM inference
- 8 project-usage guides (team reference)

k8s/portainer/bootstrap.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# portainer/bootstrap.sh
+# Deploys Portainer CE into the dashboard namespace.
+# No credentials needed — Portainer prompts you to create an admin account
+# on first browser visit.
+#
+# Prerequisites:
+#   - kubectl configured (KUBECONFIG pointing to cluster-config/kubeconfig)
+#   - helm >= 3.x
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+KUBECONFIG="${KUBECONFIG:-${REPO_ROOT}/cluster-config/kubeconfig}"
+export KUBECONFIG
+
+# ── Namespace ─────────────────────────────────────────────────────────────────
+echo "==> Creating dashboard namespace..."
+kubectl create namespace dashboard --dry-run=client -o yaml | kubectl apply -f -
+kubectl label namespace dashboard \
+  pod-security.kubernetes.io/enforce=privileged \
+  pod-security.kubernetes.io/enforce-version=latest \
+  --overwrite
+
+# ── Helm repo ─────────────────────────────────────────────────────────────────
+echo "==> Adding Portainer Helm repo..."
+helm repo add portainer https://portainer.github.io/k8s/
+helm repo update portainer
+
+# ── Portainer ─────────────────────────────────────────────────────────────────
+echo "==> Installing Portainer..."
+helm upgrade --install portainer portainer/portainer \
+  --namespace dashboard \
+  --values "${SCRIPT_DIR}/portainer-values.yaml" \
+  --wait \
+  --timeout 5m
+
+echo "==> Waiting for Portainer Deployment to be ready..."
+kubectl rollout status deployment/portainer -n dashboard --timeout=120s
+
+# ── Done ──────────────────────────────────────────────────────────────────────
+echo ""
+echo "==> Portainer is up."
+echo ""
+echo "Access Portainer UI:"
+echo "  make pf-portainer"
+echo "  http://localhost:9000"
+echo ""
+echo "First-time setup: Portainer will prompt you to create an admin account."
+echo "Choose 'Manage the local Kubernetes environment' when asked."
+echo ""
+echo "Node failure resilience tip:"
+echo "  For faster PVC failover on hard node failure, enable in Longhorn UI → Settings:"
+echo "    nodeDownPodDeletionPolicy = delete-deployment-pod"

k8s/portainer/portainer-values.yaml

@@ -0,0 +1,53 @@
+# k8s/portainer/portainer-values.yaml
+# Portainer — web UI for browsing cluster workloads, exec-ing into pods,
+# and viewing logs without kubectl. Operator-only access (ClusterIP + port-forward).
+#
+# Node failure behaviour:
+#   Portainer is a Deployment (not StatefulSet), so K8s auto-evicts and
+#   reschedules it ~5 min after a node becomes unreachable. Longhorn
+#   reattaches the PVC on the new node in ~1-2 min. Worst case: ~7-10 min.
+#
+#   To cut that down: in Longhorn UI → Settings set
+#     nodeDownPodDeletionPolicy = delete-deployment-pod
+#   Longhorn will force-delete the stuck pod immediately when the node is
+#   fenced rather than waiting for Kubernetes' eviction timeout.
+
+# ── Service ───────────────────────────────────────────────────────────────────
+# ClusterIP — no external exposure. Access via:
+#   kubectl -n dashboard port-forward svc/portainer 9000:9000
+# Portainer holds cluster-admin credentials; never expose as LoadBalancer.
+service:
+  type: ClusterIP
+
+# ── TLS ───────────────────────────────────────────────────────────────────────
+# Portainer by default redirects HTTP → HTTPS using a self-signed cert.
+# force: false disables the redirect so plain HTTP over port-forward works
+# without browser cert warnings. TLS is terminated at the ingress layer
+# if/when an ingress rule is added.
+tls:
+  force: false
+
+# ── Persistence ───────────────────────────────────────────────────────────────
+# Stores Portainer's own config: environment registrations, user accounts,
+# stack definitions, and access control settings. Longhorn provides the
+# RWO block volume. 10Gi is generous for config data but cheap on Longhorn.
+persistence:
+  enabled: true
+  storageClass: "longhorn"
+  size: 10Gi
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+# ── Scheduling ────────────────────────────────────────────────────────────────
+# Allow scheduling on talos-cp-1 (carries NoSchedule taint) so Portainer
+# keeps running even when the worker node is down.
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule