multi-cloud no mcp

infra/values/azure-prod/gitea-values.yaml

@@ -0,0 +1,7 @@
+# Azure Managed Disk (Premium SSD via CSI driver)
+persistence:
+  storageClass: managed-csi-premium
+postgresql:
+  primary:
+    persistence:
+      storageClass: managed-csi-premium

infra/values/azure-prod/opencost-values.yaml

@@ -0,0 +1,11 @@
+# Azure native pricing via Billing API
+opencost:
+  exporter:
+    customPricing:
+      enabled: true
+      provider: azure
+    azure:
+      subscriptionID: ""          # <- populate
+      clientID: ""
+      clientSecret: ""
+      tenantID: ""

infra/values/azure-prod/traefik-values.yaml

@@ -0,0 +1,16 @@
+# Azure AKS — Standard Load Balancer
+# Note: Azure Standard LB does not support Proxy Protocol.
+# Use externalTrafficPolicy: Local on the Traefik service to preserve
+# client IPs, or deploy behind Azure Application Gateway.
+service:
+  annotations:
+    service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: "/ping"
+  spec:
+    externalTrafficPolicy: Local
+ports:
+  web:
+    forwardedHeaders:
+      trustedIPs: "10.0.0.0/8,168.63.129.16/32"    # <- VNet CIDR + Azure health probe
+  websecure:
+    forwardedHeaders:
+      trustedIPs: "10.0.0.0/8,168.63.129.16/32"