feat: move Gitea traffic from gitea.nik4nao.com to gitea.home.arpa

The public domain is unreachable while moving, and the cluster had no Traefik route to Gitea at all (public or internal), leaving every Argo CD Application stuck in Unknown sync. Add a gitea.home.arpa Certificate/IngressRoute, repoint Argo CD's repoURL, Gitea's own DOMAIN/ROOT_URL/SSH_DOMAIN, the container registry references, the Gitea Actions runner, and the watch-party clone URL at the internal hostname. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-07 23:06:02 +09:00 · 2026-08-07 23:06:02 +09:00 · fd13b8aedb
commit fd13b8aedb
parent 3657519b17
39 changed files with 76 additions and 46 deletions
--- a/.claude/skills/add-service/SKILL.md
+++ b/.claude/skills/add-service/SKILL.md
@ -29,7 +29,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/<area>
    directory:
--- a/README.md
+++ b/README.md
@ -52,7 +52,7 @@ Public services under `nik4nao.com` use Let's Encrypt.
 | `https://auth.nik4nao.com` | Authentik public | Let's Encrypt |
 | `https://traefik.home.arpa` | Traefik dashboard | Internal CA |
 | `https://grafana.nik4nao.com` | Grafana | Let's Encrypt |
-| `https://gitea.nik4nao.com` | Gitea | Let's Encrypt |
+| `https://gitea.home.arpa` | Gitea | Internal CA |
 | `https://pihole.home.arpa` | Pi-hole | Internal CA |
 | `https://dashy.home.arpa` | Dashy | Internal CA |
 | `https://jellyfin.home.arpa` | Jellyfin | Internal CA |
@ -235,9 +235,10 @@ mobileconfig profile. The `ca-sync` CronJob updates those files from the

 - Argo CD Applications mostly set `prune: false`; removing resources from Git may
  require manual cleanup.
- Gitea uses a manual public `IngressRoute`; `values/gitea.yaml` has no
-  `ingress:` key at all, so the chart's own ingress is off by chart default,
-  not an explicit setting.
+- Gitea is routed at `gitea.home.arpa` via `manifests/gitea/gitea-ingress.yaml`
+  (Certificate + IngressRoute); `values/gitea.yaml` has no `ingress:` key at
+  all, so the chart's own ingress is off by chart default, not an explicit
+  setting.
 - Grafana and Loki's static hostPath PVs (`grafana-pv`, `loki-pv` in
  `manifests/monitoring/monitoring-pvs.yaml`) are currently unbound — their
  Helm-managed PVCs got dynamically provisioned via the `local-path`
--- a/ansible/roles/gitea-runner/tasks/main.yaml
+++ b/ansible/roles/gitea-runner/tasks/main.yaml
@ -61,7 +61,7 @@
      After=network.target

      [Service]
-      Environment=GITEA_INSTANCE_URL=https://gitea.nik4nao.com
+      Environment=GITEA_INSTANCE_URL=https://gitea.home.arpa
      Environment=GITEA_RUNNER_REGISTRATION_TOKEN={{ gitea_runner_token }}
      Environment=GITEA_RUNNER_NAME=minisforum
      Environment=SSL_CERT_FILE=/etc/ssl/certs/homelab-ca.pem
--- a/ansible/roles/watch-party/defaults/main.yaml
+++ b/ansible/roles/watch-party/defaults/main.yaml
@ -3,5 +3,5 @@
 # Called by: ansible/playbooks/deploy-watch-party.yaml
 # Description: Default variables for the watch-party role including repo URL and local directory.

-watch_party_repo: https://gitea.nik4nao.com/nik/watch-party.git
+watch_party_repo: https://gitea.home.arpa/nik/watch-party.git
 watch_party_dir: /Users/nik/repo/watch-party
--- a/argocd/apps/argocd-config.yaml
+++ b/argocd/apps/argocd-config.yaml
@ -6,7 +6,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/argocd
  destination:
--- a/argocd/apps/authentik-config.yaml
+++ b/argocd/apps/authentik-config.yaml
@ -6,7 +6,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/authentik
    directory:
--- a/argocd/apps/authentik.yaml
+++ b/argocd/apps/authentik.yaml
@ -20,7 +20,7 @@ spec:
      helm:
        valueFiles:
          - $values/values/authentik.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/cert-manager-config.yaml
+++ b/argocd/apps/cert-manager-config.yaml
@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/cert-manager
    directory:
--- a/argocd/apps/cert-manager.yaml
+++ b/argocd/apps/cert-manager.yaml
@ -14,7 +14,7 @@ spec:
      helm:
        valueFiles:
          - $values/values/cert-manager.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/core.yaml
+++ b/argocd/apps/core.yaml
@ -6,7 +6,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/core
    directory:
--- a/argocd/apps/gitea-secrets.yaml
+++ b/argocd/apps/gitea-secrets.yaml
@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/gitea
  destination:
--- a/argocd/apps/gitea.yaml
+++ b/argocd/apps/gitea.yaml
@ -34,7 +34,7 @@ spec:
      helm:
        valueFiles:
          - $values/values/gitea.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/home-services.yaml
+++ b/argocd/apps/home-services.yaml
@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/home-services
  destination:
--- a/argocd/apps/homeassistant.yaml
+++ b/argocd/apps/homeassistant.yaml
@ -6,7 +6,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/homeassistant
  destination:
--- a/argocd/apps/loki.yaml
+++ b/argocd/apps/loki.yaml
@ -16,7 +16,7 @@ spec:
        releaseName: loki-stack
        valueFiles:
          - $values/values/loki-stack.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/media.yaml
+++ b/argocd/apps/media.yaml
@ -6,7 +6,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/media
  destination:
--- a/argocd/apps/monitoring-secrets.yaml
+++ b/argocd/apps/monitoring-secrets.yaml
@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/monitoring
  destination:
--- a/argocd/apps/monitoring.yaml
+++ b/argocd/apps/monitoring.yaml
@ -15,7 +15,7 @@ spec:
        releaseName: kube-prometheus-stack
        valueFiles:
          - $values/values/kube-prometheus-stack.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/network-secrets.yaml
+++ b/argocd/apps/network-secrets.yaml
@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/network
    directory:
--- a/argocd/apps/network.yaml
+++ b/argocd/apps/network.yaml
@ -6,7 +6,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/network
    directory:
--- a/argocd/apps/otel-collector.yaml
+++ b/argocd/apps/otel-collector.yaml
@ -13,7 +13,7 @@ spec:
        releaseName: otel-collector
        valueFiles:
          - $values/values/otel-collector.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/pihole-debian.yaml
+++ b/argocd/apps/pihole-debian.yaml
@ -12,7 +12,7 @@ spec:
      helm:
        valueFiles:
          - $values/values/pihole-debian.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/pihole.yaml
+++ b/argocd/apps/pihole.yaml
@ -12,7 +12,7 @@ spec:
      helm:
        valueFiles:
          - $values/values/pihole.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/portfolio.yaml
+++ b/argocd/apps/portfolio.yaml
@ -6,7 +6,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: manifests/portfolio
    directory:
--- a/argocd/apps/sealed-secrets.yaml
+++ b/argocd/apps/sealed-secrets.yaml
@ -14,7 +14,7 @@ spec:
      helm:
        valueFiles:
          - $values/values/sealed-secrets.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/tempo.yaml
+++ b/argocd/apps/tempo.yaml
@ -13,7 +13,7 @@ spec:
        releaseName: tempo
        valueFiles:
          - $values/values/tempo.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/argocd/apps/traefik.yaml
+++ b/argocd/apps/traefik.yaml
@ -12,7 +12,7 @@ spec:
      helm:
        valueFiles:
          - $values/values/traefik.yaml
-    - repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    - repoURL: https://gitea.home.arpa/nik/homelab.git
      targetRevision: main
      ref: values
  destination:
--- a/config/dashy/conf.yaml
+++ b/config/dashy/conf.yaml
@ -106,7 +106,7 @@ sections:
        id: 3_services_grafana
      - title: Gitea
        icon: si-gitea
-        url: https://gitea.nik4nao.com
+        url: https://gitea.home.arpa
        target: newtab
        id: 4_services_gitea
      - title: Pi-hole
--- a/manifests/argocd/app-of-apps.yaml
+++ b/manifests/argocd/app-of-apps.yaml
@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    repoURL: https://gitea.home.arpa/nik/homelab.git
    targetRevision: main
    path: argocd/apps
  destination:
--- a/manifests/gitea/gitea-ingress.yaml
+++ b/manifests/gitea/gitea-ingress.yaml
@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitea-tls
+  namespace: gitea
+spec:
+  secretName: gitea-tls
+  issuerRef:
+    name: internal-ca-issuer
+    kind: ClusterIssuer
+  dnsNames:
+    - gitea.home.arpa
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.home.arpa`)
+      kind: Rule
+      services:
+        - name: gitea-http
+          port: 3000
+  tls:
+    secretName: gitea-tls
--- a/manifests/home-services/ai-gateway.yaml
+++ b/manifests/home-services/ai-gateway.yaml
@ -19,7 +19,7 @@ spec:
        - name: gitea-registry-secret
      containers:
        - name: ai-gateway
-          image: gitea.nik4nao.com/nik/ai-gateway:latest
+          image: gitea.home.arpa/nik/ai-gateway:latest
          ports:
            - containerPort: 50052
              name: grpc
--- a/manifests/home-services/alert-bridge.yaml
+++ b/manifests/home-services/alert-bridge.yaml
@ -19,7 +19,7 @@ spec:
        - name: gitea-registry-secret
      containers:
        - name: alert-bridge
-          image: gitea.nik4nao.com/nik/alert-bridge:latest
+          image: gitea.home.arpa/nik/alert-bridge:latest
          ports:
            - containerPort: 8080
              name: http
--- a/manifests/home-services/alexa-bridge.yaml
+++ b/manifests/home-services/alexa-bridge.yaml
@ -19,7 +19,7 @@ spec:
        - name: gitea-registry-secret
      containers:
        - name: alexa-bridge
-          image: gitea.nik4nao.com/nik/alexa-bridge:latest
+          image: gitea.home.arpa/nik/alexa-bridge:latest
          ports:
            - containerPort: 8080
              name: http
--- a/manifests/home-services/discord-bot.yaml
+++ b/manifests/home-services/discord-bot.yaml
@ -19,7 +19,7 @@ spec:
        - name: gitea-registry-secret
      containers:
        - name: discord-bot
-          image: gitea.nik4nao.com/nik/discord-bot:latest
+          image: gitea.home.arpa/nik/discord-bot:latest
          env:
            - name: DISCORD_TOKEN
              valueFrom:
--- a/manifests/home-services/ha-gateway.yaml
+++ b/manifests/home-services/ha-gateway.yaml
@ -19,7 +19,7 @@ spec:
        - name: gitea-registry-secret
      containers:
        - name: ha-gateway
-          image: gitea.nik4nao.com/nik/ha-gateway:latest
+          image: gitea.home.arpa/nik/ha-gateway:latest
          ports:
            - containerPort: 50051
              name: grpc
--- a/manifests/home-services/registry-secret.sh
+++ b/manifests/home-services/registry-secret.sh
@ -6,7 +6,7 @@ set -euo pipefail
 source "$(dirname "$0")/../../.env"
 kubectl create secret docker-registry gitea-registry-secret \
  --namespace=home-services \
-  --docker-server=gitea.nik4nao.com \
+  --docker-server=gitea.home.arpa \
  --docker-username=nik \
  --docker-password="${REGISTRY_PASSWORD}" \
  --dry-run=client -o yaml | kubectl apply -f -
--- a/manifests/home-services/tts-gateway.yaml
+++ b/manifests/home-services/tts-gateway.yaml
@ -39,7 +39,7 @@ spec:
      # very files this container needs to copy from.
      initContainers:
        - name: model-init
-          image: gitea.nik4nao.com/nik/tts-model:latest
+          image: gitea.home.arpa/nik/tts-model:latest
          command: ["cp", "-a", "/models/.", "/dest/"]
          volumeMounts:
            - name: models
@ -53,7 +53,7 @@ spec:
              memory: 64Mi
      containers:
        - name: tts-gateway
-          image: gitea.nik4nao.com/nik/tts-gateway:latest
+          image: gitea.home.arpa/nik/tts-gateway:latest
          ports:
            - containerPort: 50053
              name: grpc
@ -98,7 +98,7 @@ spec:
        # reach it over localhost, mirroring the --network host setup used
        # for local docker testing (see tts-gateway/README.md).
        - name: tts-sidecar
-          image: gitea.nik4nao.com/nik/tts-sidecar:latest
+          image: gitea.home.arpa/nik/tts-sidecar:latest
          ports:
            - containerPort: 50054
              name: http
@ -139,7 +139,7 @@ spec:
          secret:
            secretName: tts-gateway-tls
        # Populated at pod start by the model-init init container above, copying from the
-        # versioned gitea.nik4nao.com/nik/tts-model image - not a hostPath into nik-gpu's raw
+        # versioned gitea.home.arpa/nik/tts-model image - not a hostPath into nik-gpu's raw
        # disk, so this survives node reprovisioning and isn't tied to manual file placement.
        - name: models
          emptyDir:
--- a/manifests/portfolio/portfolio.yaml
+++ b/manifests/portfolio/portfolio.yaml
@ -27,7 +27,7 @@ spec:
        - name: gitea-registry
      containers:
        - name: portfolio
-          image: gitea.nik4nao.com/nik/portfolio:latest
+          image: gitea.home.arpa/nik/portfolio:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 80
--- a/values/gitea.yaml
+++ b/values/gitea.yaml
@ -13,9 +13,9 @@ gitea:

  config:
    server:
-      DOMAIN: gitea.nik4nao.com
-      ROOT_URL: https://gitea.nik4nao.com
-      SSH_DOMAIN: gitea.nik4nao.com
+      DOMAIN: gitea.home.arpa
+      ROOT_URL: https://gitea.home.arpa
+      SSH_DOMAIN: gitea.home.arpa
      SSH_PORT: 2222
    repository:
      DEFAULT_PRIVATE: true