Add GitOps stack for abrban.com with Gitea Actions CI/CD.

Harbor in-cluster builds via Kaniko, ArgoCD auto-sync, and production Helm values for abrban.com domains.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/argocd/application-platform.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: abrban-platform
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.abrban.com/abrban/cloud-host.git
+    targetRevision: main
+    path: backend/helm/cloudhost-platform
+    helm:
+      valueFiles:
+        - ../../../gitops/platform/values-abrban.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cloudhost
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false

gitops/argocd/values-bootstrap.yaml

@@ -0,0 +1,32 @@
+# Bootstrap install — uses images already cached on node (no Harbor push required)
+configs:
+  params:
+    server.insecure: true
+
+global:
+  image:
+    repository: quay.io/argoproj/argocd
+    tag: v3.4.4
+
+redis:
+  image:
+    repository: ecr-public.aws.com/docker/library/redis
+    tag: 8.2.3-alpine
+
+dex:
+  image:
+    repository: ghcr.io/dexidp/dex
+    tag: v2.45.1
+
+server:
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hostname: argocd.abrban.com
+    annotations:
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    tls: true
+    extraTls:
+      - secretName: abrban-wildcard-tls
+        hosts:
+          - argocd.abrban.com

gitops/argocd/values.yaml

@@ -0,0 +1,33 @@
+global:
+  image:
+    repository: registry.abrban.com/proxy-quay/argoproj/argocd
+    tag: v3.4.4
+  imagePullSecrets:
+    - name: registry-pull-secret
+
+redis:
+  image:
+    repository: registry.abrban.com/proxy-dockerhub/library/redis
+    tag: 8.2.3-alpine
+
+dex:
+  image:
+    repository: registry.abrban.com/proxy-dockerhub/dexidp/dex
+    tag: v2.45.1
+
+configs:
+  params:
+    server.insecure: true
+
+server:
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hostname: argocd.abrban.com
+    annotations:
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    tls: true
+    extraTls:
+      - secretName: abrban-wildcard-tls
+        hosts:
+          - argocd.abrban.com