Cut over Vault and Gitea traffic from GCE/Legion to GKE

Vault:
- Annotate vault-helm-gke Service with cloud.google.com/neg exposed_ports
  to create container-native NEGs (k8s1-bfbeff02-vault-...) in 3 zones
- Add vault-api-from-lb-gke firewall rule allowing GCP health check ranges
  (130.211.0.0/22, 35.191.0.0/16) to reach GKE pod IPs on port 8200
- Replace GCE instance group backends in google_compute_backend_service.vault
  with GKE NEG backends (RATE balancing mode, 100 req/endpoint)
- GCP Global HTTPS LB frontend unchanged — DNS stays at 34.54.164.21
- vault.neuralplatform.ai now terminates at GKE pods (all 3 NEGs HEALTHY)

Gitea:
- Change GKE Gitea Service from ClusterIP to LoadBalancer (external IP: 34.31.145.131)
- Add Cloudflare DNS A record for git.neuralplatform.ai → 34.31.145.131 (proxied)
- Remove git.neuralplatform.ai route from Legion Cloudflare tunnel config
- Add Cloudflare config rule: flexible SSL for git.neuralplatform.ai
  (origin serves HTTP/3000, CF proxies HTTPS termination)
- Scale Legion Gitea deployment to 0 replicas (PVC preserved)
- git.neuralplatform.ai now serves from GKE Gitea pod

servers/legion/apps/gitea.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app: gitea
 spec:
-  replicas: 1
+  replicas: 0  # Scaled down — Gitea has been migrated to GKE. DNS now points at GKE LB.
   strategy:
     type: Recreate
   selector:

servers/legion/dns-neuralplatform.tf

@@ -24,9 +24,9 @@ resource "cloudflare_record" "np_web_stage" {
   ttl     = 1
 }
 
-# vault.neuralplatform.ai — GCE Raft HA Vault cluster via GCP Global HTTPS LB.
+# vault.neuralplatform.ai — GCP Global HTTPS LB with managed cert.
 # DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
-# Vault nodes listen on plain HTTP 8200 internally; LB does TLS.
+# Backend is now GKE container-native NEGs (cut over from GCE instance groups).
 # IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
 resource "cloudflare_record" "np_vault" {
   zone_id = local.zone_neuralplatform_ai
@@ -36,3 +36,18 @@ resource "cloudflare_record" "np_vault" {
   proxied = false
   ttl     = 60
 }
+
+# git.neuralplatform.ai — Gitea on GKE via GCP Network LB.
+# Cloudflare proxied (provides TLS termination). Gitea listens on port 80 internally.
+# IP: external IP of the GKE LoadBalancer service in namespace gitea.
+# Get it with:
+#   kubectl --context=gke_neuron-785695_us-central1_neuron-platform -n gitea get svc gitea
+# Update content below with the actual IP, then terraform apply.
+resource "cloudflare_record" "np_gitea" {
+  zone_id = local.zone_neuralplatform_ai
+  name    = "git"
+  type    = "A"
+  content = "34.31.145.131"  # GKE LoadBalancer external IP — gitea svc in namespace gitea
+  proxied = true
+  ttl     = 1
+}

servers/legion/main.tf

@@ -108,16 +108,12 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
-    # git.neuralplatform.ai — Gitea web UI (HTTP via Traefik)
-    ingress_rule {
-      hostname = "git.neuralplatform.ai"
-      service  = "https://traefik.kube-system.svc:443"
-      origin_request {
-        no_tls_verify = true
-      }
-    }
+    # git.neuralplatform.ai — REMOVED: Gitea is now on GKE.
+    # DNS is a direct Cloudflare A record (proxied) pointing at the GKE LoadBalancer IP.
+    # See: servers/legion/dns-neuralplatform.tf (cloudflare_record.np_gitea)
 
     # ssh.git.neuralplatform.ai — Gitea SSH (direct to NodePort 30022)
+    # TODO: Route SSH to GKE Gitea LoadBalancer port 22 once IP is confirmed.
     ingress_rule {
       hostname = "ssh.git.neuralplatform.ai"
       service  = "ssh://localhost:30022"