fix cd

gitops/README.md

@@ -0,0 +1,32 @@
+# Deploying fancy-dns with k8s-helper
+
+Gitea Actions builds and pushes `fancydns/fancy-dns:<commit>` and
+`fancydns/fancy-dns:latest` on pushes to `main`. It then sends a signed
+reconcile webhook so the agent applies the published image from `./deploy/k8s`
+into namespace `dns`.
+
+## One-time setup
+
+The k8s-helper GitOps CRDs and agent must be installed, and its dashboard must
+have `K8SHELPER_GITOPS_WEBHOOK_SECRET` configured. The GitSource reuses the
+existing `dev/gitea-k8s-helper` Secret; its token must have read access to this
+repository. The Gitea Actions secret `GITOPS_WEBHOOK_SECRET` must contain the
+same webhook key. A user- or organization-level Actions secret can be shared
+with other repos.
+
+Configure this repository's Gitea webhook for push events only:
+
+- Target: `https://ui.k6n.net/api/gitops/webhooks/gitea`
+- Secret: the same value as `K8SHELPER_GITOPS_WEBHOOK_SECRET`
+
+Bootstrap the GitOps resources once with `kubectl apply -f gitops/`. The
+`dns` namespace is declared in the managed kustomization. Before bootstrapping,
+create `fancy-dns-apikey` in `dns` as described in `deploy/k8s/08-secret-apikey.yaml`
+and ensure the cert-manager-managed `fancy-dns-tls` Secret exists. The GitOps
+kustomization intentionally excludes both example Secret manifests so it never
+replaces real credentials or TLS material with placeholders.
+
+The runner uses its existing Docker login. Each successful main build sends a
+signed webhook after pushing, which avoids reconciling before the new image is
+available. `prune` is initially disabled; inspect the inventory before enabling
+it.

gitops/deployment.yaml

@@ -0,0 +1,14 @@
+apiVersion: gitops.k6n.net/v1alpha1
+kind: Deployment
+metadata:
+  name: fancy-dns
+  namespace: dev
+spec:
+  sourceRef:
+    kind: GitSource
+    name: fancy-dns
+  path: ./deploy/k8s
+  targetNamespace: dns
+  prune: false
+  wait: true
+  deletionPolicy: Orphan

gitops/gitsource.yaml

@@ -0,0 +1,17 @@
+# Keep GitOps CRs outside the path they manage.
+apiVersion: gitops.k6n.net/v1alpha1
+kind: GitSource
+metadata:
+  name: fancy-dns
+  namespace: dev
+spec:
+  url: https://git.k6n.net/mats/fancy-dns.git
+  ref:
+    branch: main
+  interval: 5m
+  secretRef:
+    name: gitea-k8s-helper
+  ignore: |
+    .gitea/
+    docs/
+    web/