feat(argocd): add portfolio app, explicit sourceRepos, coredns rewrite for riotpiao.com

- Add Application for rock/riotpiao.com repo (portfolio site)
- Replace wildcard sourceRepos with explicit repo list
- Add CoreDNS rewrite for root domain riotpiao.com

k8s/argocd/apps/60-applications.yaml

@@ -236,6 +236,32 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
+# Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
+# which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: portfolio
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/rock/riotpiao.com.git
+    targetRevision: main
+    path: infra/portfolio/base
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: portfolio
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
 # Wave 9 - per-service scoped RBAC (Role/RoleBinding), deliberately last so
 # every target namespace above already exists. Inert until kube-apiserver
 # gets --oidc-groups-claim=groups wired up (separate, not-yet-applied

k8s/argocd/projects/homelab-project.yaml

@@ -16,9 +16,12 @@ spec:
     - https://github.com/Riotpiaole/Poimen-memory.git
     - https://github.com/Riotpiaole/Poimen-workflows.git
     - https://github.com/Riotpiaole/poimen*.git
-    # In-cluster Forgejo wildcard — all rock/* repos can be onboarded without
-    # touching this AppProject. Enabled by Stage 1 (A1). Includes poimen-* repos.
-    - https://forgejo.riotpiao.com/rock/*
+    # In-cluster Forgejo repos — explicit allowlist (no wildcard)
+    - https://forgejo.riotpiao.com/rock/homelab.git
+    - https://forgejo.riotpiao.com/rock/homelab-frontend.git
+    - https://forgejo.riotpiao.com/rock/kmsvc-manage.git
+    - https://forgejo.riotpiao.com/rock/poimen.git
+    - https://forgejo.riotpiao.com/rock/riotpiao.com.git
     # Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/*
     - https://cloudnative-pg.github.io/charts
     - https://dl.gitea.com/charts/

terraform/files/coredns/Corefile

@@ -35,6 +35,7 @@
     rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name paperless.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {
         pods insecure