feat(bootstrap): Phase-0 GitHub-seed bootstrap — root-app-github (SSH seed), deploy-key Secret template, cutover URL, bootstrap.sh runner (cilium→longhorn→cnpg→forgejo-db→argocd→cutover)

k8s/bootstrap/phase4-argocd/root-app-github.yaml

@@ -1,8 +1,10 @@
-# ArgoCD Root App-of-Apps — GitHub Mirror Source
-# This is the initial configuration that breaks the circular dependency
-# Points at GitHub mirror, not Forgejo (Forgejo isn't ready yet)
-# 
-# After Forgejo is healthy and repo is pushed, use phase5-cutover/root-app-forgejo.yaml
+# ArgoCD Root App-of-Apps — GitHub seed source (circle-breaker).
+# Applied ONCE at Phase 0 (manual), BEFORE Forgejo serves the repo. Points at the
+# GitHub seed so ArgoCD can deploy everything after the control plane. After
+# Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml.
+#
+# repoURL is the SSH form — must match the `url` in the seed-repo deploy-key Secret
+# (see seed-repo-secret.example.yaml). Apply that Secret before this.
 ---
 apiVersion: v1
 kind: Namespace
@@ -16,11 +18,12 @@ metadata:
   namespace: argocd
 spec:
   description: Homelab infrastructure and applications
+  # Single-tenant homelab: all sources are trusted (GitHub seed, Forgejo, and the
+  # public Helm chart repos the app tree pulls from). Wildcard avoids silently
+  # blocking a chart host (operator.min.io, hashicorp, strimzi.io, go.temporal.io,
+  # dl.gitea.io, *.github.io, charts.*, …).
   sourceRepos:
-    - 'https://github.com/YOUR-ORG/homelab.git'  # ← REPLACE with your GitHub mirror
-    - 'https://forgejo.riotpiao.com/YOUR-ORG/homelab.git'
-    - 'https://*.github.io/*'  # Helm charts from GitHub Pages
-    - 'https://charts.*'       # Public Helm repos
+    - '*'
   destinations:
     - namespace: '*'
       server: 'https://kubernetes.default.svc'
@@ -40,16 +43,13 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: homelab
-  
   source:
-    repoURL: https://github.com/YOUR-ORG/homelab.git  # ← REPLACE with your GitHub mirror
+    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git   # GitHub seed (SSH)
     targetRevision: main
     path: k8s/argocd/apps
-    
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
-    
   syncPolicy:
     automated:
       prune: true

k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml

@@ -0,0 +1,28 @@
+# ArgoCD repo credential for the PRIVATE GitHub seed — deploy key (read-only).
+# Apply at Phase 0 BEFORE root-app-github.yaml. This is a TEMPLATE: never commit
+# the real private key.
+#
+#   ssh-keygen -t ed25519 -C "argocd@homelab" -f argocd_seed -N ""
+#   # add argocd_seed.pub → GitHub repo → Settings → Deploy keys (Read-only, no write)
+#   kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
+#   kubectl -n argocd create secret generic seed-github-repo \
+#     --from-literal=type=git \
+#     [email protected]:Riotpiaole/riotpiao.homelab.com.git \
+#     --from-file=sshPrivateKey=argocd_seed
+#   kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository
+#
+# url MUST match root-app-github.yaml's repoURL (SSH form).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: seed-github-repo
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+stringData:
+  type: git
+  url: [email protected]:Riotpiaole/riotpiao.homelab.com.git
+  sshPrivateKey: |
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    REPLACE-WITH-READ-ONLY-DEPLOY-KEY-PRIVATE-HALF — DO NOT COMMIT THE REAL KEY
+    -----END OPENSSH PRIVATE KEY-----