feat(bootstrap): Phase-0 GitHub-seed bootstrap — root-app-github (SSH seed), deploy-key Secret template, cutover URL, bootstrap.sh runner (cilium→longhorn→cnpg→forgejo-db→argocd→cutover)

k8s/bootstrap/phase4-argocd/root-app-github.yaml

@@ -1,8 +1,10 @@
-# ArgoCD Root App-of-Apps — GitHub Mirror Source
-# This is the initial configuration that breaks the circular dependency
-# Points at GitHub mirror, not Forgejo (Forgejo isn't ready yet)
-# 
-# After Forgejo is healthy and repo is pushed, use phase5-cutover/root-app-forgejo.yaml
+# ArgoCD Root App-of-Apps — GitHub seed source (circle-breaker).
+# Applied ONCE at Phase 0 (manual), BEFORE Forgejo serves the repo. Points at the
+# GitHub seed so ArgoCD can deploy everything after the control plane. After
+# Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml.
+#
+# repoURL is the SSH form — must match the `url` in the seed-repo deploy-key Secret
+# (see seed-repo-secret.example.yaml). Apply that Secret before this.
 ---
 apiVersion: v1
 kind: Namespace
@@ -16,11 +18,12 @@ metadata:
   namespace: argocd
 spec:
   description: Homelab infrastructure and applications
+  # Single-tenant homelab: all sources are trusted (GitHub seed, Forgejo, and the
+  # public Helm chart repos the app tree pulls from). Wildcard avoids silently
+  # blocking a chart host (operator.min.io, hashicorp, strimzi.io, go.temporal.io,
+  # dl.gitea.io, *.github.io, charts.*, …).
   sourceRepos:
-    - 'https://github.com/YOUR-ORG/homelab.git'  # ← REPLACE with your GitHub mirror
-    - 'https://forgejo.riotpiao.com/YOUR-ORG/homelab.git'
-    - 'https://*.github.io/*'  # Helm charts from GitHub Pages
-    - 'https://charts.*'       # Public Helm repos
+    - '*'
   destinations:
     - namespace: '*'
       server: 'https://kubernetes.default.svc'
@@ -40,16 +43,13 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: homelab
-  
   source:
-    repoURL: https://github.com/YOUR-ORG/homelab.git  # ← REPLACE with your GitHub mirror
+    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git   # GitHub seed (SSH)
     targetRevision: main
     path: k8s/argocd/apps
-    
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
-    
   syncPolicy:
     automated:
       prune: true