feat: move Gitea traffic from gitea.nik4nao.com to gitea.home.arpa

The public domain is unreachable while moving, and the cluster had no
Traefik route to Gitea at all (public or internal), leaving every Argo
CD Application stuck in Unknown sync. Add a gitea.home.arpa
Certificate/IngressRoute, repoint Argo CD's repoURL, Gitea's own
DOMAIN/ROOT_URL/SSH_DOMAIN, the container registry references, the
Gitea Actions runner, and the watch-party clone URL at the internal
hostname.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/skills/add-service/SKILL.md

@@ -29,7 +29,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/<area>
     directory:

README.md

@@ -52,7 +52,7 @@ Public services under `nik4nao.com` use Let's Encrypt.
 | `https://auth.nik4nao.com` | Authentik public | Let's Encrypt |
 | `https://traefik.home.arpa` | Traefik dashboard | Internal CA |
 | `https://grafana.nik4nao.com` | Grafana | Let's Encrypt |
-| `https://gitea.nik4nao.com` | Gitea | Let's Encrypt |
+| `https://gitea.home.arpa` | Gitea | Internal CA |
 | `https://pihole.home.arpa` | Pi-hole | Internal CA |
 | `https://dashy.home.arpa` | Dashy | Internal CA |
 | `https://jellyfin.home.arpa` | Jellyfin | Internal CA |
@@ -235,9 +235,10 @@ mobileconfig profile. The `ca-sync` CronJob updates those files from the
 
 - Argo CD Applications mostly set `prune: false`; removing resources from Git may
   require manual cleanup.
-- Gitea uses a manual public `IngressRoute`; `values/gitea.yaml` has no
+- Gitea is routed at `gitea.home.arpa` via `manifests/gitea/gitea-ingress.yaml`
-  `ingress:` key at all, so the chart's own ingress is off by chart default,
+  (Certificate + IngressRoute); `values/gitea.yaml` has no `ingress:` key at
-  not an explicit setting.
+  all, so the chart's own ingress is off by chart default, not an explicit
+  setting.
 - Grafana and Loki's static hostPath PVs (`grafana-pv`, `loki-pv` in
   `manifests/monitoring/monitoring-pvs.yaml`) are currently unbound — their
   Helm-managed PVCs got dynamically provisioned via the `local-path`

ansible/roles/gitea-runner/tasks/main.yaml

@@ -61,7 +61,7 @@
       After=network.target
 
       [Service]
-      Environment=GITEA_INSTANCE_URL=https://gitea.nik4nao.com
+      Environment=GITEA_INSTANCE_URL=https://gitea.home.arpa
       Environment=GITEA_RUNNER_REGISTRATION_TOKEN={{ gitea_runner_token }}
       Environment=GITEA_RUNNER_NAME=minisforum
       Environment=SSL_CERT_FILE=/etc/ssl/certs/homelab-ca.pem

ansible/roles/watch-party/defaults/main.yaml

@@ -3,5 +3,5 @@
 # Called by: ansible/playbooks/deploy-watch-party.yaml
 # Description: Default variables for the watch-party role including repo URL and local directory.
 
-watch_party_repo: https://gitea.nik4nao.com/nik/watch-party.git
+watch_party_repo: https://gitea.home.arpa/nik/watch-party.git
 watch_party_dir: /Users/nik/repo/watch-party

argocd/apps/argocd-config.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/argocd
   destination:

argocd/apps/authentik-config.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/authentik
     directory:

argocd/apps/authentik.yaml

@@ -20,7 +20,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/authentik.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/cert-manager-config.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/cert-manager
     directory:

argocd/apps/cert-manager.yaml

@@ -14,7 +14,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/cert-manager.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/core.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/core
     directory:

argocd/apps/gitea-secrets.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/gitea
   destination:

argocd/apps/gitea.yaml

@@ -34,7 +34,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/gitea.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/home-services.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/home-services
   destination:

argocd/apps/homeassistant.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/homeassistant
   destination:

argocd/apps/loki.yaml

@@ -16,7 +16,7 @@ spec:
         releaseName: loki-stack
         valueFiles:
           - $values/values/loki-stack.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/media.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/media
   destination:

argocd/apps/monitoring-secrets.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/monitoring
   destination:

argocd/apps/monitoring.yaml

@@ -15,7 +15,7 @@ spec:
         releaseName: kube-prometheus-stack
         valueFiles:
           - $values/values/kube-prometheus-stack.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/network-secrets.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/network
     directory:

argocd/apps/network.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/network
     directory:

argocd/apps/otel-collector.yaml

@@ -13,7 +13,7 @@ spec:
         releaseName: otel-collector
         valueFiles:
           - $values/values/otel-collector.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/pihole-debian.yaml

@@ -12,7 +12,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/pihole-debian.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/pihole.yaml

@@ -12,7 +12,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/pihole.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/portfolio.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: manifests/portfolio
     directory:

argocd/apps/sealed-secrets.yaml

@@ -14,7 +14,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/sealed-secrets.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/tempo.yaml

@@ -13,7 +13,7 @@ spec:
         releaseName: tempo
         valueFiles:
           - $values/values/tempo.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

argocd/apps/traefik.yaml

@@ -12,7 +12,7 @@ spec:
       helm:
         valueFiles:
           - $values/values/traefik.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
       targetRevision: main
       ref: values
   destination:

config/dashy/conf.yaml

@@ -106,7 +106,7 @@ sections:
         id: 3_services_grafana
       - title: Gitea
         icon: si-gitea
-        url: https://gitea.nik4nao.com
+        url: https://gitea.home.arpa
         target: newtab
         id: 4_services_gitea
       - title: Pi-hole

manifests/argocd/app-of-apps.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
     targetRevision: main
     path: argocd/apps
   destination:

manifests/gitea/gitea-ingress.yaml

@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-tls
+  namespace: gitea
+spec:
+  secretName: gitea-tls
+  issuerRef:
+    name: internal-ca-issuer
+    kind: ClusterIssuer
+  dnsNames:
+    - gitea.home.arpa
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.home.arpa`)
+      kind: Rule
+      services:
+        - name: gitea-http
+          port: 3000
+  tls:
+    secretName: gitea-tls

manifests/home-services/ai-gateway.yaml

@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: ai-gateway
-          image: gitea.nik4nao.com/nik/ai-gateway:latest
+          image: gitea.home.arpa/nik/ai-gateway:latest
           ports:
             - containerPort: 50052
               name: grpc

manifests/home-services/alert-bridge.yaml

@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: alert-bridge
-          image: gitea.nik4nao.com/nik/alert-bridge:latest
+          image: gitea.home.arpa/nik/alert-bridge:latest
           ports:
             - containerPort: 8080
               name: http

manifests/home-services/alexa-bridge.yaml

@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: alexa-bridge
-          image: gitea.nik4nao.com/nik/alexa-bridge:latest
+          image: gitea.home.arpa/nik/alexa-bridge:latest
           ports:
             - containerPort: 8080
               name: http

manifests/home-services/discord-bot.yaml

@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: discord-bot
-          image: gitea.nik4nao.com/nik/discord-bot:latest
+          image: gitea.home.arpa/nik/discord-bot:latest
           env:
             - name: DISCORD_TOKEN
               valueFrom:

manifests/home-services/ha-gateway.yaml

@@ -19,7 +19,7 @@ spec:
         - name: gitea-registry-secret
       containers:
         - name: ha-gateway
-          image: gitea.nik4nao.com/nik/ha-gateway:latest
+          image: gitea.home.arpa/nik/ha-gateway:latest
           ports:
             - containerPort: 50051
               name: grpc

manifests/home-services/registry-secret.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 source "$(dirname "$0")/../../.env"
 kubectl create secret docker-registry gitea-registry-secret \
   --namespace=home-services \
-  --docker-server=gitea.nik4nao.com \
+  --docker-server=gitea.home.arpa \
   --docker-username=nik \
   --docker-password="${REGISTRY_PASSWORD}" \
   --dry-run=client -o yaml | kubectl apply -f -

manifests/home-services/tts-gateway.yaml

@@ -39,7 +39,7 @@ spec:
       # very files this container needs to copy from.
       initContainers:
         - name: model-init
-          image: gitea.nik4nao.com/nik/tts-model:latest
+          image: gitea.home.arpa/nik/tts-model:latest
           command: ["cp", "-a", "/models/.", "/dest/"]
           volumeMounts:
             - name: models
@@ -53,7 +53,7 @@ spec:
               memory: 64Mi
       containers:
         - name: tts-gateway
-          image: gitea.nik4nao.com/nik/tts-gateway:latest
+          image: gitea.home.arpa/nik/tts-gateway:latest
           ports:
             - containerPort: 50053
               name: grpc
@@ -98,7 +98,7 @@ spec:
         # reach it over localhost, mirroring the --network host setup used
         # for local docker testing (see tts-gateway/README.md).
         - name: tts-sidecar
-          image: gitea.nik4nao.com/nik/tts-sidecar:latest
+          image: gitea.home.arpa/nik/tts-sidecar:latest
           ports:
             - containerPort: 50054
               name: http
@@ -139,7 +139,7 @@ spec:
           secret:
             secretName: tts-gateway-tls
         # Populated at pod start by the model-init init container above, copying from the
-        # versioned gitea.nik4nao.com/nik/tts-model image - not a hostPath into nik-gpu's raw
+        # versioned gitea.home.arpa/nik/tts-model image - not a hostPath into nik-gpu's raw
         # disk, so this survives node reprovisioning and isn't tied to manual file placement.
         - name: models
           emptyDir:

manifests/portfolio/portfolio.yaml

@@ -27,7 +27,7 @@ spec:
         - name: gitea-registry
       containers:
         - name: portfolio
-          image: gitea.nik4nao.com/nik/portfolio:latest
+          image: gitea.home.arpa/nik/portfolio:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 80

values/gitea.yaml

@@ -13,9 +13,9 @@ gitea:
 
   config:
     server:
-      DOMAIN: gitea.nik4nao.com
+      DOMAIN: gitea.home.arpa
-      ROOT_URL: https://gitea.nik4nao.com
+      ROOT_URL: https://gitea.home.arpa
-      SSH_DOMAIN: gitea.nik4nao.com
+      SSH_DOMAIN: gitea.home.arpa
       SSH_PORT: 2222
     repository:
       DEFAULT_PRIVATE: true