Add Gitea Actions CI, ArgoCD Application, and Gitea Packages wiring

- .gitea/workflows/ci.yml: build → seo:lint → e2e → image build/push →
  bump k8s image tag and commit back (paths-ignore + [skip ci] guard)
- argocd/bcs-website-application.yaml: ArgoCD App (internal Gitea repoURL, k8s path)
- k8s: image → Gitea Packages path; kustomization images newTag stanza
- ADR-0007 (Gitea Actions + Packages), supersedes GHCR/GitHub bits of ADR-0001
- Reconcile gitops-deployment-strategy.md to Gitea

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/gitops-deployment-strategy.md

@@ -3,34 +3,49 @@
 ## Goal
 
 Deploy the BlueCap Strategies Astro site to the existing k3s cluster using GitOps, without
-giving GitHub Actions direct access to the homelab cluster.
+giving Gitea Actions direct access to the homelab cluster.
 
 The homelab already runs **ArgoCD** in k3s, so this strategy uses ArgoCD as the reconciler
-rather than standing up a second GitOps controller (Flux). ArgoCD pulls from Git and GHCR; the
-cluster is never exposed to GitHub.
+rather than standing up a second GitOps controller (Flux). ArgoCD pulls from Git and the image
+registry; the cluster is never exposed to the CI system.
 
 Desired operating model:
 
 1. Edit the site locally in this repository.
 2. Commit changes.
 3. Push to `main`.
-4. GitHub Actions runs tests and builds a container image.
-5. GitHub Actions pushes the image to GHCR, tagged with the immutable `<git-sha>`.
+4. Gitea Actions runs tests and builds a container image.
+5. Gitea Actions pushes the image to Gitea Packages, tagged with the immutable `<git-sha>`.
 6. Git is updated with the new desired image tag (CI commits the tag into `k8s/`).
 7. ArgoCD, running inside k3s, detects the Git change.
 8. ArgoCD syncs the Kubernetes manifests (Kustomize).
 9. k3s pulls the new image and rolls the website deployment.
 10. Traefik serves the updated site publicly.
 
-GitHub never receives kubeconfig or direct network access to the homelab cluster. The cluster
+The CI runner never receives kubeconfig or direct network access to the homelab cluster. The cluster
 pulls from Git and the image registry.
 
-## Prerequisites (not yet done)
+> **Concrete implementation is Gitea, not GitHub/GHCR** — see [ADR-0007](adr/0007-gitea-actions-and-packages.md).
+> CI = Gitea Actions (`.gitea/workflows/ci.yml`); registry = Gitea Packages
+> (`10.66.15.22:3000/bmr_bluecap/bcs-website`); ArgoCD Application in `argocd/bcs-website-application.yaml`.
+> Any lingering GitHub/GHCR wording below is the generic model; substitute Gitea/Gitea-Packages.
 
-- **This repository is not yet a git repo.** GitOps requires a remote (GitHub) that both CI and
-  ArgoCD can read. `git init`, push to a GitHub repo, then wire ArgoCD to that repo.
-- Decide the GHCR image path (replace the placeholder `ghcr.io/your-org/...` in
-  `k8s/deployment.yaml`).
+## Prerequisites
+
+Done: repo pushed to Gitea (`bmr_bluecap/bcs-website`, private); `k8s/deployment.yaml` image set to
+the Gitea Packages path; ArgoCD Application manifest written.
+
+**Still to do before the first deploy works (homelab infra):**
+- **k3s must trust the HTTP registry.** Add a `registries.yaml` entry for `10.66.15.22:3000` as
+  insecure/HTTP (via the k3s role `k3s_registry_mirrors`), then restart k3s — otherwise pods can't
+  pull the image.
+- **Runner host dockerd** needs `10.66.15.22:3000` in `insecure-registries` to push over HTTP.
+- **Docker usable from job containers** (act_runner socket passthrough) — or switch the build to
+  kaniko.
+- **Package visibility:** make the container package **public** (simplest; image is only the public
+  site), or keep it private and add an imagePullSecret (`k8s/deployment.yaml`), ideally via the
+  installed External Secrets operator.
+- Apply the ArgoCD Application (once) or add it to the homelab-gitops app-of-apps.
 
 ## Cluster Findings
 
@@ -50,7 +65,7 @@ Edge / DNS / TLS (research 2026-06-05):
 ## Repository & Image Strategy
 
 - **Mono-repo:** Keep site source and k8s manifests in the same repository.
-- **GHCR:** Use GitHub Container Registry for images.
+- **Gitea Packages:** Use Gitea's built-in container registry (`10.66.15.22:3000`) for images.
 - **Immutable tags:** Deploy via `<git-sha>` tags, never `latest`. `latest` defeats ArgoCD's
   ability to detect and record what is actually running.
 - **Manifests:** Plain Kustomize under `k8s/` (already present). ArgoCD consumes
@@ -76,7 +91,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://github.com/<owner>/bcs-website.git
+    repoURL: http://10.66.15.22:3000/bmr_bluecap/bcs-website.git
     targetRevision: main
     path: k8s
   destination:
@@ -99,7 +114,7 @@ spec:
 Two options — this strategy recommends **Option A** for simplicity and auditability:
 
 ### Option A (recommended): CI commits the image tag
-GitHub Actions, after pushing the image, patches the image tag in `k8s/` (via
+Gitea Actions, after pushing the image, patches the image tag in `k8s/` (via
 `kustomize edit set image` or a `newTag` field) and commits back to `main`. ArgoCD auto-syncs the
 new tag. Every deploy is a Git commit traceable to a source SHA — clean rollback via `git revert`.
 
@@ -107,26 +122,26 @@ Add to `k8s/kustomization.yaml`:
 
 ```yaml
 images:
-  - name: ghcr.io/<owner>/bluecap-strategies-website
+  - name: 10.66.15.22:3000/bmr_bluecap/bcs-website
     newTag: <ci-sets-this>
 ```
 
 ### Option B: ArgoCD Image Updater
-Install ArgoCD Image Updater and annotate the Application to watch the GHCR repo and write back
+Install ArgoCD Image Updater and annotate the Application to watch the Gitea Packages repo and write back
 the tag. Removes the CI commit-back step but adds a controller and registry-credential wiring.
 Only adopt if the homelab already runs Image Updater for other apps.
 
-## Phase 2: CI Pipeline (GitHub Actions)
+## Phase 2: CI Pipeline (Gitea Actions)
 
 Workflow on push to `main`:
 
 1. **Quality gate:** `npm ci`, `npm run typecheck`, `npm run build`.
 2. **E2E validation:** `npm run test:e2e` (Playwright) where browser deps are available.
-3. **Publish:** build the Docker image, push to GHCR tagged `<git-sha>`.
-4. **GitOps sync (Option A):** `kustomize edit set image ...=ghcr.io/<owner>/...:<git-sha>`,
+3. **Publish:** build the Docker image, push to Gitea Packages tagged `<git-sha>`.
+4. **GitOps sync (Option A):** `kustomize edit set image ...=10.66.15.22:3000/bmr_bluecap/bcs-website:<git-sha>`,
    commit and push to `main`. ArgoCD reconciles.
 
-CI never touches the cluster — it only writes to GHCR and Git.
+CI never touches the cluster — it only writes to Gitea Packages and Git.
 
 ## Phase 3: Staging (Launch Readiness)
 
@@ -139,7 +154,7 @@ Application tracking it.
 
 ### 1. Secret hygiene — Git-managed credentials
 Avoid manual `kubectl create secret`. Use **Sealed Secrets** or **External Secrets Operator** so
-GHCR pull tokens and contact-form keys are encrypted in Git and the site is reproducible from
+Gitea Packages pull tokens and contact-form keys are encrypted in Git and the site is reproducible from
 source alone. Match whichever the homelab ArgoCD stack already standardizes on.
 
 ### 2. Edge authority — Cloudflare hardening