Add GitOps stack for abrban.com with Gitea Actions CI/CD.

Harbor in-cluster builds via Kaniko, ArgoCD auto-sync, and production Helm values for abrban.com domains.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/jobs/build-platform-kaniko.yaml

@@ -0,0 +1,60 @@
+# In-cluster platform build (Kaniko → Harbor abrban/). Apply via scripts/trigger-platform-build.sh
+# Base images pulled via Harbor proxy-cache — no separate mirror job.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: build-platform-images
+  namespace: cloudhost-builds
+spec:
+  ttlSecondsAfterFinished: 3600
+  backoffLimit: 1
+  template:
+    spec:
+      restartPolicy: Never
+      imagePullSecrets:
+        - name: registry-pull-secret
+      initContainers:
+        - name: git-clone
+          image: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
+          env:
+            - name: GIT_REPO
+              value: http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git
+            - name: GIT_REF
+              value: main
+          command:
+            - sh
+            - -ec
+            - |
+              git clone --depth=1 --branch "${GIT_REF}" "${GIT_REPO}" /workspace
+          volumeMounts:
+            - name: workspace
+              mountPath: /workspace
+      containers:
+        - name: kaniko
+          image: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
+          env:
+            - name: IMAGE_TAG
+              value: bootstrap
+          command:
+            - sh
+            - -ec
+            - |
+              set -eux
+              REG="harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
+              /kaniko/executor \
+                --dockerfile=/workspace/backend/Dockerfile \
+                --context=dir:///workspace/backend \
+                --destination="${REG}/cloudhost-backend:${IMAGE_TAG}" \
+                --insecure --skip-tls-verify
+              /kaniko/executor \
+                --dockerfile=/workspace/frontend/Dockerfile \
+                --context=dir:///workspace/frontend \
+                --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com \
+                --destination="${REG}/cloudhost-frontend:${IMAGE_TAG}" \
+                --insecure --skip-tls-verify
+          volumeMounts:
+            - name: workspace
+              mountPath: /workspace
+      volumes:
+        - name: workspace
+          emptyDir: {}

gitops/jobs/image-import-pod.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: image-import
+  namespace: cloudhost
+spec:
+  nodeName: abr
+  restartPolicy: Never
+  hostNetwork: true
+  containers:
+    - name: import
+      image: quay.io/skopeo/stable:latest
+      command:
+        - sh
+        - -ec
+        - |
+          sleep 3600
+      securityContext:
+        privileged: true
+      volumeMounts:
+        - name: containerd-sock
+          mountPath: /run/containerd/containerd.sock
+        - name: containerd-sock-k3s
+          mountPath: /run/k3s/containerd/containerd.sock
+        - name: import-dir
+          mountPath: /import
+  volumes:
+    - name: containerd-sock
+      hostPath:
+        path: /run/k3s/containerd/containerd.sock
+        type: Socket
+    - name: containerd-sock-k3s
+      hostPath:
+        path: /run/k3s/containerd/containerd.sock
+        type: Socket
+    - name: import-dir
+      emptyDir: {}

gitops/jobs/seed-ci-images.yaml

@@ -0,0 +1,33 @@
+# Bootstrap: copy act_runner + kaniko into abrban/ (kubelet cannot use proxy-cache reliably)
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: seed-ci-images
+  namespace: cloudhost
+spec:
+  ttlSecondsAfterFinished: 3600
+  backoffLimit: 2
+  template:
+    spec:
+      restartPolicy: Never
+      imagePullSecrets:
+        - name: registry-pull-secret
+      containers:
+        - name: skopeo
+          image: registry.abrban.com/proxy-quay/skopeo/stable:latest
+          envFrom:
+            - secretRef:
+                name: registry-egress-proxy
+          command:
+            - sh
+            - -ec
+            - |
+              set -eux
+              DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
+              skopeo copy --dest-tls-verify=false \
+                docker://docker.gitea.com/gitea/act_runner:0.2.11 \
+                "${DEST}/act-runner:0.2.11"
+              skopeo copy --dest-tls-verify=false \
+                docker://gcr.io/kaniko-project/executor:v1.23.2 \
+                "${DEST}/kaniko-executor:v1.23.2"
+              echo SEED_OK