deploy: private package pull via External Secrets; pull over public HTTPS (no k3s restart)

- k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config)
- CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted)
- ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao
- deployment uses imagePullSecrets: gitea-registry
- .env added to .dockerignore

k8s/deployment.yaml

@@ -13,14 +13,15 @@ spec:
       labels:
         app: bluecap-website
     spec:
-      # If the Gitea package is PRIVATE, create a docker-registry secret (ideally via
-      # External Secrets) named `gitea-registry` in this namespace and uncomment:
-      # imagePullSecrets:
-      #   - name: gitea-registry
+      # Private Gitea package -> pull auth from the External-Secrets-managed dockerconfigjson
+      # (see k8s/externalsecret-registry.yaml).
+      imagePullSecrets:
+        - name: gitea-registry
       containers:
         - name: website
-          # Tag is managed by CI via kustomize (see k8s/kustomization.yaml `images`).
-          image: 10.66.15.22:3000/bmr_bluecap/bcs-website:latest
+          # Pulled over public HTTPS (valid cert -> no node registry config). Tag managed by CI
+          # via kustomize (see k8s/kustomization.yaml `images`).
+          image: git.7tl-homelab.com/bmr_bluecap/bcs-website:latest
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

k8s/externalsecret-registry.yaml

@@ -0,0 +1,26 @@
+# Materializes a docker-registry pull secret (gitea-registry) from OpenBao via the existing
+# ClusterSecretStore, so the private Gitea package can be pulled by k3s without a static secret
+# in Git. Store a read:package Gitea PAT in OpenBao at `cluster/bluecap-registry` with fields
+# `username` (e.g. bmr_bluecap) and `password` (the token).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-registry
+  namespace: bluecap-strategies
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: openbao-cluster
+    kind: ClusterSecretStore
+  target:
+    name: gitea-registry
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"git.7tl-homelab.com":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+  data:
+    - secretKey: username
+      remoteRef: { key: bluecap-registry, property: username }
+    - secretKey: password
+      remoteRef: { key: bluecap-registry, property: password }

k8s/kustomization.yaml

@@ -1,14 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- namespace.yaml
-- configmap.yaml
-- deployment.yaml
-- service.yaml
-- ingress.yaml
+  - namespace.yaml
+  - configmap.yaml
+  - externalsecret-registry.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
 
 # CI updates newTag to the immutable git-sha via `kustomize edit set image` (see .gitea/workflows/ci.yml).
+# Name is the public HTTPS pull endpoint that k3s uses.
 images:
-- name: 10.66.15.22:3000/bmr_bluecap/bcs-website
-  newName: 10.66.15.22:3000/bmr_bluecap/bcs-website
-  newTag: 79f2e8a78b9f
+  - name: git.7tl-homelab.com/bmr_bluecap/bcs-website
+    newTag: latest