fixes

.gitea/workflows/scan.yaml

@@ -0,0 +1,20 @@
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Install TruffleHog
+      run: |
+        curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
+          | sh -s -- -b /usr/local/bin
+    - name: Secret Scanning
+      run: trufflehog git file://. --fail --no-update --results=verified,unknown

.tofu/platforms/upc/prod/main.tf

@@ -1,64 +1,3 @@
-# =============================================================================
-# UpCloud Workload Cluster
-# =============================================================================
-# A lean UCS cluster for running application workloads. No managed data
-# services — those live on the platform cluster. ArgoCD (on the platform
-# cluster) deploys apps to this cluster via the app-of-apps pattern.
-#
-# Platform components deployed by deploy-workload.sh:
-#   nginx-ingress, cert-manager, external-dns, external-secrets, alloy
-#
-# Usage:
-#   tofu init && tofu plan && tofu apply
-#   ./sync-tofu-outputs.sh --env upcloud-workload
-#   ./deploy-workload.sh --env upcloud-workload
-# =============================================================================
-
-variable "prefix" {
-  description = "Prefix for resource names"
-  type        = string
-  default     = "clst-workload"
-}
-
-variable "zone" {
-  description = "UpCloud zone"
-  type        = string
-  default     = "no-svg1"
-}
-
-variable "node_plan" {
-  description = "UpCloud server plan for worker nodes"
-  type        = string
-  default     = "2xCPU-4GB"
-}
-
-variable "node_count" {
-  description = "Number of worker nodes"
-  type        = number
-  default     = 2
-}
-
-variable "network_cidr" {
-  description = "CIDR block for the private network"
-  type        = string
-  default     = "10.110.0.0/24"
-}
-
-variable "control_plane_ip_filter" {
-  description = "CIDRs allowed to access the K8s API"
-  type        = list(string)
-  default     = ["0.0.0.0/0"]
-}
-
-variable "tags" {
-  description = "Labels to apply to resources"
-  type        = map(string)
-  default = {
-    Environment = "workload"
-    ManagedBy   = "tofu"
-  }
-}
-
 module "cluster" {
   source = "../modules/cluster"
 
@@ -76,45 +15,3 @@ module "cluster" {
     ManagedBy   = "tofu"
   }
 }
-
-# ─── Networking ───────────────────────────────────────────────────────
-
-resource "upcloud_router" "kubernetes" {
-  name = "${var.prefix}-workload-router"
-}
-
-resource "upcloud_gateway" "kubernetes" {
-  name     = "${var.prefix}-workload-gateway"
-  zone     = var.zone
-  features = ["nat"]
-  router {
-    id = upcloud_router.kubernetes.id
-  }
-}
-
-resource "upcloud_network" "kubernetes" {
-  name   = "${var.prefix}-workload-network"
-  zone   = var.zone
-  router = upcloud_router.kubernetes.id
-
-  ip_network {
-    address            = var.network_cidr
-    dhcp               = true
-    dhcp_default_route = true
-    family             = "IPv4"
-    gateway            = cidrhost(var.network_cidr, 1)
-  }
-
-  depends_on = [upcloud_gateway.kubernetes]
-}
-
-# ─── Kubernetes Cluster ───────────────────────────────────────────────
-
-resource "upcloud_kubernetes_cluster" "main-prod" {
-  name                    = "${var.prefix}-workload"
-  zone                    = var.zone
-  network                 = upcloud_network.kubernetes.id
-  control_plane_ip_filter = var.control_plane_ip_filter
-
-  private_node_groups = true
-}

.tofu/scripts/get-kubeconfig.sh

@@ -5,9 +5,56 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TOFU_ROOT="$(dirname "$SCRIPT_DIR")"
 PROJECT_ROOT="$(dirname "$TOFU_ROOT")"
 
-CLUSTER="${1:?Usage: $0 <cluster> (e.g., aks-dev, eks-prod)}"
+usage() {
+  cat <<EOF
+Usage: $0 <cluster> --envtype <dev|prod|workload>
+
+  Fetch (or reuse) a kubeconfig for the given cluster.
+  Platform is read from the cluster prefix (<platform>-...).
+  Env type must be supplied explicitly — it is no longer inferred
+  from the cluster name, so names like 'upc-forte-group' work.
+
+  Examples:
+    $0 aks-dev          --envtype dev
+    $0 upc-forte-group  --envtype prod
+    $0 eks-workload     --envtype workload
+EOF
+  exit "${1:-0}"
+}
+
+CLUSTER=""
+ENVTYPE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --envtype)    ENVTYPE="${2:-}"; shift 2 ;;
+    --envtype=*)  ENVTYPE="${1#*=}"; shift ;;
+    -h|--help)    usage 0 ;;
+    -*)           echo "Unknown option: $1"; usage 1 ;;
+    *)
+      if [[ -z "$CLUSTER" ]]; then
+        CLUSTER="$1"; shift
+      else
+        echo "Error: unexpected argument '$1'"; usage 1
+      fi
+      ;;
+  esac
+done
+
+[[ -z "$CLUSTER" ]] && { echo "Error: <cluster> argument required"; usage 1; }
+[[ -z "$ENVTYPE" ]] && { echo "Error: --envtype <dev|prod|workload> required"; usage 1; }
+
+case "$ENVTYPE" in
+  dev|prod|workload) ;;
+  *) echo "Error: invalid --envtype '$ENVTYPE'. Expected: dev, prod, workload"; exit 1 ;;
+esac
+
 PLATFORM="${CLUSTER%%-*}"
-ENV="${CLUSTER#*-}"
+ENV="$ENVTYPE"
+
+case "$PLATFORM" in
+  aks|eks|gke|upc) ;;
+  *) echo "Error: unknown platform '$PLATFORM'. Expected: aks, eks, gke, upc"; exit 1 ;;
+esac
 
 KUBECONFIG_FILE="$PROJECT_ROOT/private/$CLUSTER/kubeconfig"
 
@@ -53,10 +100,6 @@ else
       CLUSTER_ID=$(tofu output -raw cluster_id 2>/dev/null || echo "${UPCLOUD_CLUSTER_ID:-}")
       upctl kubernetes config "$CLUSTER_ID" > "$KUBECONFIG_FILE"
       ;;
-    *)
-      echo "Error: unknown platform '$PLATFORM'"
-      exit 1
-      ;;
   esac
 
   chmod 600 "$KUBECONFIG_FILE"

.tofu/scripts/setup-cluster.sh

@@ -8,25 +8,33 @@ PROJECT_ROOT="$(dirname "$TOFU_ROOT")"
 # ─── Usage ────────────────────────────────────────────────────────────
 usage() {
   cat <<EOF
-Usage: $0 <cluster> [options]
+Usage: $0 <cluster> --envtype <dev|prod|workload> [options]
 
   Provision a Kubernetes cluster using OpenTofu.
-  Mirrors bootstrap.sh convention: cluster = <platform>-<env>
+  Cluster name is opaque — platform is read from its prefix
+  (<platform>-...), env is taken from --envtype.
 
-  Clusters:   aks-dev | aks-prod | eks-dev | eks-prod
-              gke-dev | gke-prod | upc-dev | upc-prod
-              <platform>-workload (for workload clusters)
+  Platforms (inferred from cluster prefix):
+    aks | eks | gke | upc
+
+  Env types (required via --envtype):
+    dev       Platform cluster, development
+    prod      Platform cluster, production
+    workload  Lean cluster for application workloads (no managed data
+              services — those run on the platform cluster)
 
   Options:
-    --plan        Plan only, don't apply
-    --destroy     Destroy the cluster (use teardown-cluster.sh instead)
-    --auto        Skip confirmation prompts
-    -h, --help    Show this help
+    --envtype <type>   dev | prod | workload  (required)
+    --plan             Plan only, don't apply
+    --destroy          Destroy the cluster (use teardown-cluster.sh instead)
+    --auto             Skip confirmation prompts
+    -h, --help         Show this help
 
   Examples:
-    $0 aks-dev
-    $0 eks-prod --plan
-    $0 upc-dev --auto
+    $0 aks-dev          --envtype dev
+    $0 eks-prod         --envtype prod --plan
+    $0 upc-forte-group  --envtype prod --auto
+    $0 upc-workload     --envtype workload
 
   Prerequisites:
     - tofu, kubectl, helm installed
@@ -41,17 +49,20 @@ EOF
 
 # ─── Parse arguments ──────────────────────────────────────────────────
 CLUSTER=""
+ENVTYPE=""
 PLAN_ONLY=false
 DESTROY=false
 AUTO_APPROVE=false
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --plan)       PLAN_ONLY=true; shift ;;
-    --destroy)    DESTROY=true; shift ;;
-    --auto)       AUTO_APPROVE=true; shift ;;
-    -h|--help)    usage 0 ;;
-    -*)           echo "Unknown option: $1"; usage 1 ;;
+    --plan)        PLAN_ONLY=true; shift ;;
+    --destroy)     DESTROY=true; shift ;;
+    --auto)        AUTO_APPROVE=true; shift ;;
+    --envtype)     ENVTYPE="${2:-}"; shift 2 ;;
+    --envtype=*)   ENVTYPE="${1#*=}"; shift ;;
+    -h|--help)     usage 0 ;;
+    -*)            echo "Unknown option: $1"; usage 1 ;;
     *)
       if [[ -z "$CLUSTER" ]]; then
         CLUSTER="$1"
@@ -65,10 +76,16 @@ while [[ $# -gt 0 ]]; do
 done
 
 [[ -z "$CLUSTER" ]] && { echo "Error: <cluster> argument required"; usage 1; }
+[[ -z "$ENVTYPE" ]] && { echo "Error: --envtype <dev|prod|workload> required"; usage 1; }
 
-# ─── Map cluster → platform + env ────────────────────────────────────
-PLATFORM="${CLUSTER%%-*}"   # aks-dev → aks
-ENV="${CLUSTER#*-}"         # aks-dev → dev
+case "$ENVTYPE" in
+  dev|prod|workload) ;;
+  *) echo "Error: invalid --envtype '$ENVTYPE'. Expected: dev, prod, workload"; exit 1 ;;
+esac
+
+# ─── Resolve platform + env ───────────────────────────────────────────
+PLATFORM="${CLUSTER%%-*}"   # cluster prefix → platform (e.g. upc-forte-group → upc)
+ENV="$ENVTYPE"              # env comes from --envtype, not the cluster name
 
 case "$PLATFORM" in
   aks|eks|gke|upc) ;;

_app-of-apps-upc-forte-group.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: infrastructure-apps
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: infrastructure-apps
+    app.kubernetes.io/part-of: platform
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    targetRevision: HEAD
+    path: infra/overlays/upc-forte-group
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true

apps/overlays/upc-dev/forte-drop/forte-drop-subdomains-ingressroute.yaml

@@ -1,39 +0,0 @@
-# Wildcard routing for per-slug forte drops: <slug>.drop.forteapps.net -> the forte-drop
-# web pod. The forteapp chart only emits a single exact Host(`drop.forteapps.net`) route
-# (the apex: admin + /api + public /shared drops), so this ADDITIVE IngressRoute adds the
-# wildcard. Kept in launchpad (forte-drop-specific) rather than the shared forteapp chart.
-#
-# It targets the SAME service the chart's route does — forte-drop-app:3000 — whose
-# targetPort is the auth sidecar (service.yaml: targetPort = auth.sidecarPort when auth is
-# on). So wildcard subdomains flow service:3000 -> sidecar -> app, i.e. they are Forte-login
-# gated exactly like the admin root. A forteOnly drop is therefore never served un-gated.
-#
-# priority: 1 (intentionally LOW). Traefik orders routers by rule-length by default, and the
-# regex string is longer than Host(`mcp.drop.forteapps.net`); without an explicit low
-# priority this regex would OUTRANK and STEAL mcp.drop.forteapps.net (and the apex) into the
-# web pod. priority:1 guarantees the exact Host() routers (mcp release, chart apex) always win;
-# only real per-slug subdomains fall through to here. The app's reserved-slug check
-# (mcp/www/api/admin/app) is a second line of defence.
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: forte-drop-subdomains
-  namespace: forte-drop
-  labels:
-    app.kubernetes.io/name: forte-drop
-    app.kubernetes.io/part-of: apps
-    app.kubernetes.io/managed-by: argocd
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    # Traefik v3 (chart 28.x) HostRegexp takes a Go RE2 pattern. Verify the rendered
-    # router against mcp./www./app./apex/<real-slug> before relying on it in prod.
-    - match: HostRegexp(`^[a-z0-9-]+\.drop\.forteapps\.net$`)
-      kind: Rule
-      priority: 1
-      services:
-        - name: forte-drop-app
-          port: 3000
-  tls:
-    secretName: wildcard-drop-forteapps-net-tls

apps/overlays/upc-dev/forte-drop/keycloak-client-forte-drop.yaml

@@ -1,8 +1,3 @@
-# Labeled config Secret read by the Keycloak Client Registrar. Kyverno clones it
-# to the keycloak namespace; a CronJob registers the OIDC client in the forte
-# realm and writes the credentials back as forte-drop-oidc-credentials in THIS
-# namespace (~2 min). The forte-helm auth sidecar (auth.type: oidc) consumes that
-# registrar-created Secret automatically — no manual SealedSecret step needed.
 apiVersion: v1
 kind: Secret
 metadata:

apps/overlays/upc-dev/forte-drop/kustomization.yaml

@@ -5,5 +5,3 @@ resources:
 - keycloak-client-forte-drop.yaml
 - forte-drop-pdb.yaml
 - forte-drop-secrets-sealed.yaml
-- wildcard-drop-tls-certificate.yaml
-- forte-drop-subdomains-ingressroute.yaml

apps/overlays/upc-dev/forte-drop/wildcard-drop-tls-certificate.yaml

@@ -1,35 +0,0 @@
----
-# Wildcard TLS cert for the per-slug drop subdomains: <slug>.drop.forteapps.net.
-# forte_drop serves forte-login drops on their own subdomain (gated by the auth
-# sidecar), so each drop needs a valid cert for *.drop.forteapps.net — a name the
-# existing *.forteapps.net wildcard CANNOT cover (TLS wildcards match one label only).
-#
-# Scope: this cert covers ONLY *.drop.forteapps.net. The apex drop.forteapps.net is
-# NOT included here — it is served by the forteapp chart's own Certificate (secret
-# forte-drop-tls, dnsNames: [drop.forteapps.net]) and/or the existing *.forteapps.net
-# wildcard, so adding it here would be redundant.
-#
-# Issued DIRECTLY into the forte-drop namespace (not via the chart) so the app's
-# Traefik IngressRoute — which must reference a TLS secret in its OWN namespace — can
-# use it without cross-namespace cloning. This is the single issuer of secret
-# wildcard-drop-forteapps-net-tls; the forte-drop-subdomains IngressRoute references
-# that secret. The letsencrypt-prod dns01 solver is authorized for this name via its
-# selector.dnsZones (forteapps.net).
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-drop-forteapps-net
-  namespace: forte-drop
-spec:
-  secretName: wildcard-drop-forteapps-net-tls
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
-  dnsNames:
-  - '*.drop.forteapps.net' # per-slug forte drop subdomains
-  duration: 2160h0m0s # 90 days
-  renewBefore: 720h0m0s # renew 30 days before expiry
-  privateKey:
-    algorithm: RSA
-    encoding: PKCS1
-    size: 4096

apps/overlays/upc-dev/kustomization.yaml

@@ -1,13 +1,19 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ../../base
+- ../../base/musicman
+- ../../base/dot-ai-stack
+- ../../base/argo-mcp
 - forte-drop-postgresql
 - forte-drop
 - forte-drop-mcp
 
-# No patches needed — base apps already default to "upc-dev" value paths
-# (upc-dev is the default/base cluster).
-# forte-drop (postgres + web + mcp) and dbunk-demo are upc-dev-only apps — their
-# values hardcode upc-dev hosts (drop.forteapps.net etc.) and must not sync to
-# upc-prod, so they live here in the overlay rather than in apps/base/.
+patches:
+# dot-ai-stack: swap upc-dev → upc-forte-group
+- target:
+    kind: Application
+    name: dot-ai-stack
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-dev/dot-ai-stack-values.yaml

apps/overlays/upc-forte-group/kustomization.yaml

@@ -1,8 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- dot-ai-stack
-- mcp10x
-- musicman
-- ts-mcp
-- argo-mcp
+- ../../base/mcp10x
+- ../../base/ts-mcp
+

apps/overlays/upc-prod/kustomization.yaml

@@ -2,13 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ../../base
-
-patches:
-# dot-ai-stack: swap upc-dev → upc-prod
-- target:
-    kind: Application
-    name: dot-ai-stack
-  patch: |
-    - op: replace
-      path: /spec/sources/0/helm/valueFiles/1
-      value: $values/infra/values/upc-prod/dot-ai-stack-values.yaml

bootstrap.sh

@@ -3,7 +3,7 @@
 # in case of  $'\r': command not found error, run command below first
 # sed -i 's/\r$//' ./bootstrap.sh
 
-CLUSTER="${1:?Usage: ./bootstrap.sh <cluster> (upc-dev|upc-prod|aks-dev|aks-prod|eks-dev|eks-prod|gke-dev|gke-prod)}"
+CLUSTER="${1:?Usage: ./bootstrap.sh <cluster>  # e.g. upc-dev, upc-prod, upc-forte-group, aks-dev, eks-prod, gke-dev — must match clusters/<cluster>.yaml}"
 
 echo "running $0 for cluster: ${CLUSTER}..."
 

cluster-resources/letsencrypt-issuer.yaml

@@ -24,15 +24,8 @@ spec:
             name: azuredns-config
             key: client-secret
       selector:
-        # NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
-        # matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
-        # named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
-        # instead suffix-matches the zone apex AND every subdomain at any depth, so this single
-        # entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
-        # drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
-        # Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
-        # to match fall through to the http01 solver below.
-        dnsZones:
+        dnsNames:
+        - '*.forteapps.net'
         - 'forteapps.net'
     # HTTP-01 fallback for non-wildcard certificates
     - http01:
@@ -65,15 +58,8 @@ spec:
             name: azuredns-config
             key: client-secret
       selector:
-        # NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
-        # matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
-        # named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
-        # instead suffix-matches the zone apex AND every subdomain at any depth, so this single
-        # entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
-        # drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
-        # Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
-        # to match fall through to the http01 solver below.
-        dnsZones:
+        dnsNames:
+        - '*.forteapps.net'
         - 'forteapps.net'
     # HTTP-01 fallback for non-wildcard certificates
     - http01:

clusters/upc-forte-group.yaml

@@ -0,0 +1,12 @@
+# Cluster config reference — values must match the corresponding overlay files.
+# Read by bootstrap.sh at install time; NOT auto-propagated to ArgoCD value files.
+clusterName: prod-fd-no-svg1             # → infra/values/upc-forte-group/argocd-values.yaml (notifications.context.clusterName)
+domain: fortedigital.com                 # → infra/values/base/gitea-values.yaml, renovate-values.yaml, keycloak-values.yaml (subdomains)
+argocdDomain: argocd.127.0.0.1.nip.io   # → infra/values/upc-forte-group/argocd-values.yaml (global.domain)
+grafanaDomain: grafana.fortedigital.com  # → infra/values/upc-forte-group/grafana-values.yaml (ingress.hosts)
+keycloakDomain: id.fortedigital.com      # → infra/values/upc-forte-group/keycloak-values.yaml (ingress.hostname)
+dotaiDomain: kubemcp.fortedigital.com    # → infra/values/upc-forte-group/dot-ai-stack-values.yaml (dot-ai.ingress.host)
+dotaiUiDomain: kubemcpui.fortedigital.com # → infra/values/upc-forte-group/dot-ai-stack-values.yaml (dot-ai-ui.ingress.host)
+letsencryptEmail: danijel.simeunovic@fortedigital.com # → cluster-resources/letsencrypt-issuer.yaml (spec.acme.email)
+trustedIPs: "172.16.1.0/24"             # → infra/values/upc-forte-group/traefik-values.yaml (ports.*.trustedIPs)
+cloudProvider: upcloud                   # → determines overlay directory and cloud-specific LB/storage annotations

infra/base/gitea/gitea.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://dl.gitea.com/charts
     chart: gitea
-    targetRevision: "12.5.0"
+    targetRevision: "12.6.0"
     helm:
       releaseName: gitea
       valueFiles:

infra/overlays/upc-dev/kustomization.yaml

@@ -28,12 +28,3 @@ resources:
 
 # No patches needed — base already has "upc-dev" paths
 # upc-dev is the default/base cluster
-
-patches:
-- target:
-    kind: Application
-    name: databunker
-  patch: |
-    - op: add
-      path: /spec/sources/0/helm/valueFiles/-
-      value: $values/infra/values/upc-dev/databunker-values.yaml

infra/overlays/upc-forte-group/kustomization.yaml

@@ -0,0 +1,61 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../base/cert-manager-application
+- ../../base/cluster-resources-application
+- ../../base/enterprise-apps
+- ../../base/fluent-bit
+- ../../base/gitea
+- ../../base/gitea-actions
+- ../../base/grafana
+- ../../base/grafana-dashboards
+- ../../base/homepage
+- ../../base/karpor
+- ../../base/keycloak
+- ../../base/kyverno
+- ../../base/kyverno-policies
+- ../../base/loki
+- ../../base/opencost
+- ../../base/prometheus
+- ../../base/renovate
+- ../../base/sealedsecrets
+- ../../base/tempo
+- ../../base/traefik-application
+- ../../base/vault
+
+patches:
+# Traefik: swap upc-dev → upc-forte-group
+- target:
+    kind: Application
+    name: traefik
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-forte-group/traefik-values.yaml
+
+# Grafana: swap upc-dev → upc-forte-group  
+- target:
+    kind: Application
+    name: grafana
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-forte-group/grafana-values.yaml
+
+# OpenCost: swap upc-dev → upc-forte-group
+- target:
+    kind: Application
+    name: opencost
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-forte-group/opencost-values.yaml
+
+# Gitea: swap upc-dev → upc-forte-group
+- target:
+    kind: Application
+    name: gitea
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-forte-group/gitea-values.yaml

infra/values/upc-forte-group/argocd-values.yaml

@@ -0,0 +1,5 @@
+global:
+  domain: argocd.fortedigital.com
+notifications:
+  context:
+    clusterName: "prod-fd-no-svg1"

infra/values/upc-forte-group/gitea-values.yaml

@@ -0,0 +1,50 @@
+# UpCloud storage class for Gitea and its embedded PostgreSQL
+persistence:
+  storageClass: upcloud-block-storage-maxiops
+postgresql:
+  primary:
+    persistence:
+      storageClass: upcloud-block-storage-maxiops
+
+gitea:
+  # -- Gitea app.ini configuration
+  config:
+    APP_NAME: "Forte Git"
+
+    server:
+      DOMAIN: source.forteapps.net
+      ROOT_URL: https://source.forteapps.net
+      SSH_DOMAIN: source.forteapps.net
+
+
+# -- Ingress via Traefik with Let's Encrypt TLS
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    gethomepage.dev/enabled: "true"
+    gethomepage.dev/name: "Gitea"
+    gethomepage.dev/description: "Git hosting & CI/CD"
+    gethomepage.dev/group: "DevOps"
+    gethomepage.dev/icon: "gitea"
+    gethomepage.dev/href: "https://source.forteapps.net"
+    gethomepage.dev/widget.type: "gitea"
+    gethomepage.dev/widget.url: "https://source.forteapps.net"
+    gethomepage.dev/widget.key: "{{HOMEPAGE_VAR_GITEA_TOKEN}}"
+  hosts:
+  - host: source.forteapps.net
+    paths:
+    - path: /
+      pathType: Prefix
+  tls:
+  - secretName: gitea-tls
+    hosts:
+    - source.forteapps.net
+
+# -- Git repository storage
+persistence:
+  enabled: true
+  size: 20Gi
+  accessModes:
+  - ReadWriteOnce

infra/values/upc-forte-group/grafana-values.yaml

@@ -0,0 +1,3 @@
+ingress:
+  hosts:
+  - grafana.fortedigital.com

infra/values/upc-forte-group/keycloak-values.yaml

@@ -0,0 +1,2 @@
+ingress:
+  hostname: id.forteapps.com

infra/values/upc-forte-group/opencost-values.yaml

@@ -0,0 +1,15 @@
+# UpCloud custom pricing (no native OpenCost integration)
+opencost:
+  exporter:
+    customPricing:
+      enabled: true
+      provider: custom
+      costModel:
+        description: "UpCloud 4-node cluster pricing"
+        CPU: "5.86"
+        RAM: "1.46"
+        GPU: "0"
+        storage: "0.34"
+        zoneNetworkEgress: "0"
+        regionNetworkEgress: "0"
+        internetNetworkEgress: "0"

infra/values/upc-forte-group/traefik-values.yaml

@@ -0,0 +1,13 @@
+service:
+  annotations: {}
+ports:
+  web:
+    proxyProtocol:
+      trustedIPs: "10.0.0.0/16"
+    forwardedHeaders:
+      trustedIPs: "10.0.0.0/16"
+  websecure:
+    proxyProtocol:
+      trustedIPs: "10.0.0.0/16"
+    forwardedHeaders:
+      trustedIPs: "10.0.0.0/16"

infra/values/upc-prod/dot-ai-stack-values.yaml

@@ -1,8 +0,0 @@
-dot-ai:
-  ingress:
-    host: kubemcp.fortedigital.com
-  webUI:
-    baseUrl: http://kubemcpui.fortedigital.com
-dot-ai-ui:
-  ingress:
-    host: kubemcpui.fortedigital.com