Add GitOps stack for abrban.com with Gitea Actions CI/CD.

Harbor in-cluster builds via Kaniko, ArgoCD auto-sync, and production Helm values for abrban.com domains.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -19,6 +19,10 @@ spec:
       labels:
         app: {{ include "cloudhost-platform.backend.fullname" . }}
     spec:
+      {{- with .Values.backend.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       initContainers:
         {{- if .Values.postgres.enabled }}
         - name: wait-postgres
@@ -88,6 +92,11 @@ spec:
             - name: {{ $key }}
               value: {{ $val | quote }}
             {{- end }}
+          {{- if .Values.backend.sourceStorage.enabled }}
+          envFrom:
+            - secretRef:
+                name: {{ .Values.backend.sourceStorage.existingSecret }}
+          {{- end }}
           volumeMounts:
             - name: uploads
               mountPath: /app/uploads

backend/helm/cloudhost-platform/templates/frontend-deployment.yaml

@@ -17,6 +17,10 @@ spec:
       labels:
         app: {{ include "cloudhost-platform.frontend.fullname" . }}
     spec:
+      {{- with .Values.frontend.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: frontend
           image: {{ include "cloudhost-platform.frontendImage" . | quote }}

backend/helm/cloudhost-platform/templates/ingress.yaml

@@ -7,7 +7,7 @@ metadata:
   labels:
     {{- include "cloudhost-platform.labels" . | nindent 4 }}
   annotations:
-    {{- if .Values.ingress.tls.enabled }}
+    {{- if and .Values.ingress.tls.enabled (not .Values.ingress.tls.secretName) }}
     cert-manager.io/cluster-issuer: {{ .Values.ingress.tls.clusterIssuer | quote }}
     {{- end }}
     {{- if and .Values.ingress.singleHost.enabled .Values.ingress.singleHost.apiPath }}

backend/helm/cloudhost-platform/values-production.example.yaml

@@ -36,6 +36,10 @@ ingress:
     clusterIssuer: letsencrypt-prod
 
 backend:
+  # Enable after copying ceph-app-sources-credentials secret into the cloudhost namespace
+  sourceStorage:
+    enabled: false
+    existingSecret: ceph-app-sources-credentials
   env:
     PLATFORM_DOMAIN: apps.example.com
     REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000

backend/helm/cloudhost-platform/values.yaml

@@ -42,8 +42,13 @@ redis:
 backend:
   enabled: true
   replicas: 1
+  imagePullSecrets:
+    - name: registry-pull-secret
   uploads:
     size: 20Gi
+  sourceStorage:
+    enabled: false
+    existingSecret: ceph-app-sources-credentials
   resources: {}
   extraEnv: {}
   env:
@@ -66,6 +71,8 @@ backend:
 frontend:
   enabled: true
   replicas: 1
+  imagePullSecrets:
+    - name: registry-pull-secret
   resources: {}
 
 # JWT secrets — set in production (values-production.example.yaml)