diff --git a/.claude/skills/add-service/SKILL.md b/.claude/skills/add-service/SKILL.md
index 1a30043..a15c716 100644
--- a/.claude/skills/add-service/SKILL.md
+++ b/.claude/skills/add-service/SKILL.md
@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/<area>
     directory:
diff --git a/README.md b/README.md
index a0dd076..08cac04 100644
--- a/README.md
+++ b/README.md
@@ -52,7 +52,7 @@ Public services under `nik4nao.com` use Let's Encrypt.
 | `https://auth.nik4nao.com` | Authentik public | Let's Encrypt |
 | `https://traefik.home.arpa` | Traefik dashboard | Internal CA |
 | `https://grafana.nik4nao.com` | Grafana | Let's Encrypt |
-| `https://gitea.nik4nao.com` | Gitea | Let's Encrypt |
+| `https://gitea.home.arpa` | Gitea | Internal CA |
 | `https://pihole.home.arpa` | Pi-hole | Internal CA |
 | `https://dashy.home.arpa` | Dashy | Internal CA |
 | `https://jellyfin.home.arpa` | Jellyfin | Internal CA |
@@ -235,9 +235,10 @@ mobileconfig profile. The `ca-sync` CronJob updates those files from the
 
 - Argo CD Applications mostly set `prune: false`; removing resources from Git may
   require manual cleanup.
-- Gitea uses a manual public `IngressRoute`; `values/gitea.yaml` has no
-  `ingress:` key at all, so the chart's own ingress is off by chart default,
-  not an explicit setting.
+- Gitea is routed at `gitea.home.arpa` via `manifests/gitea/gitea-ingress.yaml`
+  (Certificate + IngressRoute); `values/gitea.yaml` has no `ingress:` key at
+  all, so the chart's own ingress is off by chart default, not an explicit
+  setting.
 - Grafana and Loki's static hostPath PVs (`grafana-pv`, `loki-pv` in
   `manifests/monitoring/monitoring-pvs.yaml`) are currently unbound — their
   Helm-managed PVCs got dynamically provisioned via the `local-path`
diff --git a/ansible/roles/gitea-runner/tasks/main.yaml b/ansible/roles/gitea-runner/tasks/main.yaml
index a215500..01bb5a9 100644
--- a/ansible/roles/gitea-runner/tasks/main.yaml
+++ b/ansible/roles/gitea-runner/tasks/main.yaml
@@ -61,7 +61,7 @@
       After=network.target
 
       [Service]
-      Environment=GITEA_INSTANCE_URL=https://gitea.nik4nao.com
+      Environment=GITEA_INSTANCE_URL=https://gitea.home.arpa
       Environment=GITEA_RUNNER_REGISTRATION_TOKEN={{ gitea_runner_token }}
       Environment=GITEA_RUNNER_NAME=minisforum
       Environment=SSL_CERT_FILE=/etc/ssl/certs/homelab-ca.pem
diff --git a/ansible/roles/watch-party/defaults/main.yaml b/ansible/roles/watch-party/defaults/main.yaml
index 8a77b36..0d8b4a1 100644
--- a/ansible/roles/watch-party/defaults/main.yaml
+++ b/ansible/roles/watch-party/defaults/main.yaml
@@ -3,5 +3,5 @@
 # Called by: ansible/playbooks/deploy-watch-party.yaml
 # Description: Default variables for the watch-party role including repo URL and local directory.
 
-watch_party_repo: https://gitea.nik4nao.com/nik/watch-party.git
+watch_party_repo: https://gitea.home.arpa/nik/watch-party.git
 watch_party_dir: /Users/nik/repo/watch-party
diff --git a/argocd/apps/argocd-config.yaml b/argocd/apps/argocd-config.yaml
index fff4ebe..d25f219 100644
--- a/argocd/apps/argocd-config.yaml
+++ b/argocd/apps/argocd-config.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/argocd
   destination:
diff --git a/argocd/apps/authentik-config.yaml b/argocd/apps/authentik-config.yaml
index da5ac35..14faaf1 100644
--- a/argocd/apps/authentik-config.yaml
+++ b/argocd/apps/authentik-config.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/authentik
     directory:
diff --git a/argocd/apps/authentik.yaml b/argocd/apps/authentik.yaml
index 1025dbe..f6f7a32 100644
--- a/argocd/apps/authentik.yaml
+++ b/argocd/apps/authentik.yaml
@@ -20,7 +20,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/authentik.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/cert-manager-config.yaml b/argocd/apps/cert-manager-config.yaml
index 0985ace..d97a029 100644
--- a/argocd/apps/cert-manager-config.yaml
+++ b/argocd/apps/cert-manager-config.yaml
@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/cert-manager
     directory:
diff --git a/argocd/apps/cert-manager.yaml b/argocd/apps/cert-manager.yaml
index e904d4f..86df96c 100644
--- a/argocd/apps/cert-manager.yaml
+++ b/argocd/apps/cert-manager.yaml
@@ -14,7 +14,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/cert-manager.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/core.yaml b/argocd/apps/core.yaml
index 6b9a0cd..01b8e99 100644
--- a/argocd/apps/core.yaml
+++ b/argocd/apps/core.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/core
     directory:
diff --git a/argocd/apps/gitea-secrets.yaml b/argocd/apps/gitea-secrets.yaml
index c10dd17..c749242 100644
--- a/argocd/apps/gitea-secrets.yaml
+++ b/argocd/apps/gitea-secrets.yaml
@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/gitea
   destination:
diff --git a/argocd/apps/gitea.yaml b/argocd/apps/gitea.yaml
index 9d58269..d6e4dd3 100644
--- a/argocd/apps/gitea.yaml
+++ b/argocd/apps/gitea.yaml
@@ -34,7 +34,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/gitea.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/home-services.yaml b/argocd/apps/home-services.yaml
index cc9dfe7..bc7eaa3 100644
--- a/argocd/apps/home-services.yaml
+++ b/argocd/apps/home-services.yaml
@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/home-services
   destination:
diff --git a/argocd/apps/homeassistant.yaml b/argocd/apps/homeassistant.yaml
index c8617a5..7cfe29b 100644
--- a/argocd/apps/homeassistant.yaml
+++ b/argocd/apps/homeassistant.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/homeassistant
   destination:
diff --git a/argocd/apps/loki.yaml b/argocd/apps/loki.yaml
index 69d354b..478e423 100644
--- a/argocd/apps/loki.yaml
+++ b/argocd/apps/loki.yaml
@@ -16,7 +16,7 @@ spec:
         releaseName: loki-stack
         valueFiles:
           - $values/values/loki-stack.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/media.yaml b/argocd/apps/media.yaml
index f884ab5..0ac56fa 100644
--- a/argocd/apps/media.yaml
+++ b/argocd/apps/media.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/media
   destination:
diff --git a/argocd/apps/monitoring-secrets.yaml b/argocd/apps/monitoring-secrets.yaml
index e1fa857..1f66da5 100644
--- a/argocd/apps/monitoring-secrets.yaml
+++ b/argocd/apps/monitoring-secrets.yaml
@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/monitoring
   destination:
diff --git a/argocd/apps/monitoring.yaml b/argocd/apps/monitoring.yaml
index 778d669..ebcb248 100644
--- a/argocd/apps/monitoring.yaml
+++ b/argocd/apps/monitoring.yaml
@@ -15,7 +15,7 @@ spec:
         releaseName: kube-prometheus-stack
         valueFiles:
           - $values/values/kube-prometheus-stack.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/network-secrets.yaml b/argocd/apps/network-secrets.yaml
index 4cfc4b7..dab544d 100644
--- a/argocd/apps/network-secrets.yaml
+++ b/argocd/apps/network-secrets.yaml
@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/network
     directory:
diff --git a/argocd/apps/network.yaml b/argocd/apps/network.yaml
index d8f31e3..5ce6c16 100644
--- a/argocd/apps/network.yaml
+++ b/argocd/apps/network.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/network
     directory:
diff --git a/argocd/apps/otel-collector.yaml b/argocd/apps/otel-collector.yaml
index 9fa4313..83c137a 100644
--- a/argocd/apps/otel-collector.yaml
+++ b/argocd/apps/otel-collector.yaml
@@ -13,7 +13,7 @@ spec:
         releaseName: otel-collector
         valueFiles:
           - $values/values/otel-collector.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/pihole-debian.yaml b/argocd/apps/pihole-debian.yaml
index 6146849..0228f71 100644
--- a/argocd/apps/pihole-debian.yaml
+++ b/argocd/apps/pihole-debian.yaml
@@ -12,7 +12,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/pihole-debian.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/pihole.yaml b/argocd/apps/pihole.yaml
index c39b9fe..855bd1e 100644
--- a/argocd/apps/pihole.yaml
+++ b/argocd/apps/pihole.yaml
@@ -12,7 +12,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/pihole.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/portfolio.yaml b/argocd/apps/portfolio.yaml
index 166e8ab..4343ac3 100644
--- a/argocd/apps/portfolio.yaml
+++ b/argocd/apps/portfolio.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/portfolio
     directory:
diff --git a/argocd/apps/sealed-secrets.yaml b/argocd/apps/sealed-secrets.yaml
index c43c1f3..e04f026 100644
--- a/argocd/apps/sealed-secrets.yaml
+++ b/argocd/apps/sealed-secrets.yaml
@@ -14,7 +14,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/sealed-secrets.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/tempo.yaml b/argocd/apps/tempo.yaml
index 50eb23a..0fbc272 100644
--- a/argocd/apps/tempo.yaml
+++ b/argocd/apps/tempo.yaml
@@ -13,7 +13,7 @@ spec:
         releaseName: tempo
         valueFiles:
           - $values/values/tempo.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/argocd/apps/traefik.yaml b/argocd/apps/traefik.yaml
index 1304407..2c2872f 100644
--- a/argocd/apps/traefik.yaml
+++ b/argocd/apps/traefik.yaml
@@ -12,7 +12,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/traefik.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:
diff --git a/config/dashy/conf.yaml b/config/dashy/conf.yaml
index 9d5d094..5d5b1d2 100644
--- a/config/dashy/conf.yaml
+++ b/config/dashy/conf.yaml
@@ -106,7 +106,7 @@ sections:
         id: 3_services_grafana
       - title: Gitea
         icon: si-gitea
-        url: https://gitea.nik4nao.com
+        url: https://gitea.home.arpa
         target: newtab
         id: 4_services_gitea
       - title: Pi-hole
diff --git a/manifests/argocd/app-of-apps.yaml b/manifests/argocd/app-of-apps.yaml
index fb5682d..5160ad8 100644
--- a/manifests/argocd/app-of-apps.yaml
+++ b/manifests/argocd/app-of-apps.yaml
@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: argocd/apps
   destination:
diff --git a/manifests/gitea/gitea-ingress.yaml b/manifests/gitea/gitea-ingress.yaml
new file mode 100644
index 0000000..9478c49
--- /dev/null
+++ b/manifests/gitea/gitea-ingress.yaml
@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-tls
+  namespace: gitea
+spec:
+  secretName: gitea-tls
+  issuerRef:
+    name: internal-ca-issuer
+    kind: ClusterIssuer
+  dnsNames:
+    - gitea.home.arpa
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.home.arpa`)
+      kind: Rule
+      services:
+        - name: gitea-http
+          port: 3000
+  tls:
+    secretName: gitea-tls
diff --git a/manifests/home-services/ai-gateway.yaml b/manifests/home-services/ai-gateway.yaml
index b26b04a..8d9b70b 100644
--- a/manifests/home-services/ai-gateway.yaml
+++ b/manifests/home-services/ai-gateway.yaml
@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: ai-gateway
-          image: gitea.nik4nao.com/nik/ai-gateway:latest
+          image: gitea.home.arpa/nik/ai-gateway:latest
           ports:
             - containerPort: 50052
               name: grpc
diff --git a/manifests/home-services/alert-bridge.yaml b/manifests/home-services/alert-bridge.yaml
index 3a7329e..f49d886 100644
--- a/manifests/home-services/alert-bridge.yaml
+++ b/manifests/home-services/alert-bridge.yaml
@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: alert-bridge
-          image: gitea.nik4nao.com/nik/alert-bridge:latest
+          image: gitea.home.arpa/nik/alert-bridge:latest
           ports:
             - containerPort: 8080
               name: http
diff --git a/manifests/home-services/alexa-bridge.yaml b/manifests/home-services/alexa-bridge.yaml
index 75585bf..fd38055 100644
--- a/manifests/home-services/alexa-bridge.yaml
+++ b/manifests/home-services/alexa-bridge.yaml
@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: alexa-bridge
-          image: gitea.nik4nao.com/nik/alexa-bridge:latest
+          image: gitea.home.arpa/nik/alexa-bridge:latest
           ports:
             - containerPort: 8080
               name: http
diff --git a/manifests/home-services/discord-bot.yaml b/manifests/home-services/discord-bot.yaml
index f5f19bb..6619a52 100644
--- a/manifests/home-services/discord-bot.yaml
+++ b/manifests/home-services/discord-bot.yaml
@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: discord-bot
-          image: gitea.nik4nao.com/nik/discord-bot:latest
+          image: gitea.home.arpa/nik/discord-bot:latest
           env:
             - name: DISCORD_TOKEN
               valueFrom:
diff --git a/manifests/home-services/ha-gateway.yaml b/manifests/home-services/ha-gateway.yaml
index ca6cead..b428229 100644
--- a/manifests/home-services/ha-gateway.yaml
+++ b/manifests/home-services/ha-gateway.yaml
@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: ha-gateway
-          image: gitea.nik4nao.com/nik/ha-gateway:latest
+          image: gitea.home.arpa/nik/ha-gateway:latest
           ports:
             - containerPort: 50051
               name: grpc
diff --git a/manifests/home-services/registry-secret.sh b/manifests/home-services/registry-secret.sh
index f49df04..4391378 100644
--- a/manifests/home-services/registry-secret.sh
+++ b/manifests/home-services/registry-secret.sh
@@ -6,7 +6,7 @@ set -euo pipefail
 source "$(dirname "$0")/../../.env"
 kubectl create secret docker-registry gitea-registry-secret \
   --namespace=home-services \
-  --docker-server=gitea.nik4nao.com \
+  --docker-server=gitea.home.arpa \
   --docker-username=nik \
   --docker-password="${REGISTRY_PASSWORD}" \
   --dry-run=client -o yaml | kubectl apply -f -
\ No newline at end of file
diff --git a/manifests/home-services/tts-gateway.yaml b/manifests/home-services/tts-gateway.yaml
index fe0754e..b1e33ed 100644
--- a/manifests/home-services/tts-gateway.yaml
+++ b/manifests/home-services/tts-gateway.yaml
@@ -39,7 +39,7 @@ spec:
       # very files this container needs to copy from.
       initContainers:
         - name: model-init
-          image: gitea.nik4nao.com/nik/tts-model:latest
+          image: gitea.home.arpa/nik/tts-model:latest
           command: ["cp", "-a", "/models/.", "/dest/"]
           volumeMounts:
             - name: models
@@ -53,7 +53,7 @@ spec:
               memory: 64Mi
       containers:
         - name: tts-gateway
-          image: gitea.nik4nao.com/nik/tts-gateway:latest
+          image: gitea.home.arpa/nik/tts-gateway:latest
           ports:
             - containerPort: 50053
               name: grpc
@@ -98,7 +98,7 @@ spec:
         # reach it over localhost, mirroring the --network host setup used
         # for local docker testing (see tts-gateway/README.md).
         - name: tts-sidecar
-          image: gitea.nik4nao.com/nik/tts-sidecar:latest
+          image: gitea.home.arpa/nik/tts-sidecar:latest
           ports:
             - containerPort: 50054
               name: http
@@ -139,7 +139,7 @@ spec:
           secret:
             secretName: tts-gateway-tls
         # Populated at pod start by the model-init init container above, copying from the
-        # versioned gitea.nik4nao.com/nik/tts-model image - not a hostPath into nik-gpu's raw
+        # versioned gitea.home.arpa/nik/tts-model image - not a hostPath into nik-gpu's raw
         # disk, so this survives node reprovisioning and isn't tied to manual file placement.
         - name: models
           emptyDir:
diff --git a/manifests/portfolio/portfolio.yaml b/manifests/portfolio/portfolio.yaml
index 2ed7441..7824303 100644
--- a/manifests/portfolio/portfolio.yaml
+++ b/manifests/portfolio/portfolio.yaml
@@ -27,7 +27,7 @@ spec:
         - name: gitea-registry
       containers:
         - name: portfolio
-          image: gitea.nik4nao.com/nik/portfolio:latest
+          image: gitea.home.arpa/nik/portfolio:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 80
diff --git a/values/gitea.yaml b/values/gitea.yaml
index 8ec439e..570666b 100644
--- a/values/gitea.yaml
+++ b/values/gitea.yaml
@@ -13,9 +13,9 @@ gitea:
 
   config:
     server:
-      DOMAIN: gitea.nik4nao.com
-      ROOT_URL: https://gitea.nik4nao.com
-      SSH_DOMAIN: gitea.nik4nao.com
+      DOMAIN: gitea.home.arpa
+      ROOT_URL: https://gitea.home.arpa
+      SSH_DOMAIN: gitea.home.arpa
       SSH_PORT: 2222
     repository:
       DEFAULT_PRIVATE: true