Add GitOps stack for abrban.com with Gitea Actions CI/CD.

Harbor in-cluster builds via Kaniko, ArgoCD auto-sync, and production Helm values for abrban.com domains.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/apply-k3s-registries.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Route registry.abrban.com pulls to harbor-core (HTTP) for proxy-cache support.
+set -euo pipefail
+
+NS="${NS:-kube-system}"
+NODE="${NODE:-abr}"
+HARBOR_CORE_IP="${HARBOR_CORE_IP:-$(kubectl -n cloudhost get svc harbor-core -o jsonpath='{.spec.clusterIP}')}"
+REG_USER="${REG_USER:-harbor_registry_user}"
+REG_PASS="${REG_PASS:-$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)}"
+
+kubectl -n "${NS}" delete pod k3s-registries-setup --ignore-not-found
+
+kubectl -n "${NS}" run k3s-registries-setup \
+  --image=rancher/mirrored-library-busybox:1.36.1 \
+  --restart=Never \
+  --overrides="$(cat <<EOF
+{
+  "apiVersion": "v1",
+  "spec": {
+    "nodeName": "${NODE}",
+    "hostNetwork": true,
+    "containers": [{
+      "name": "setup",
+      "image": "rancher/mirrored-library-busybox:1.36.1",
+      "securityContext": {"privileged": true},
+      "command": ["sh", "-ec", "mkdir -p /host/etc/rancher/k3s && cat > /host/etc/rancher/k3s/registries.yaml <<'REGEOF'\nmirrors:\n  registry.abrban.com:\n    endpoint:\n      - http://${HARBOR_CORE_IP}\n  \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n    endpoint:\n      - \\\"http://127.0.0.1:30500\\\"\nconfigs:\n  registry.abrban.com:\n    auth:\n      username: ${REG_USER}\n      password: ${REG_PASS}\n  \\\"${HARBOR_CORE_IP}\\\":\n    auth:\n      username: ${REG_USER}\n      password: ${REG_PASS}\n  \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n    auth:\n      username: admin\n      password: \\\"\\\"\n  \\\"127.0.0.1:30500\\\":\n    auth:\n      username: admin\n      password: \\\"\\\"\nREGEOF\nnsenter -t 1 -m -u -n -i -- systemctl restart k3s 2>/dev/null || true\necho k3s-restarted\nsleep 30"],
+      "volumeMounts": [{"name": "host", "mountPath": "/host"}]
+    }],
+    "volumes": [{"name": "host", "hostPath": {"path": "/"}}]
+  }
+}
+EOF
+)"
+
+kubectl -n "${NS}" wait --for=condition=Ready pod/k3s-registries-setup --timeout=180s || true
+kubectl -n "${NS}" logs k3s-registries-setup