gitea-runner: add container.options to mount /usr/local/bin/kubectl:ro
from the Legion host into every act_runner job container. Eliminates
per-run curl download in CI workflows.
ingress: change registry ingress hostname from registry.nook.family to
registry.neuralplatform.ai. Matches the domain used in Neuron CI and
neuron.yaml image reference. DNS CNAME + tunnel route already added.
Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.
New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)
Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.
Will Anderson