Initial commit: imcu.ro HA k3s cluster manifests

- 3-node HA cluster (k3s v1.36.3+k3s1, embedded etcd) on Hetzner
- Netbird VPN mesh (wt0) for all cluster traffic
- Longhorn distributed storage (2 replicas, /var/lib/longhorn/)
- Traefik ingress (3 replicas, LoadBalancer on all node IPs)
- cert-manager with Let's Encrypt (auto-renewing TLS)
- Gitea (git + container registry) with SQLite on Longhorn
- 4 migrated workloads: wolsey, school-games (3 variants), randomly
- All HelmCharts and workload manifests as YAML
- deploy.sh for one-shot cluster setup

cluster-config/clusterissuer.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: admin@imcu.ro
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+    - http01:
+        ingress:
+          class: traefik

cluster-config/image-pull-secret-template.txt

@@ -0,0 +1,17 @@
+# Image Pull Secret Template
+#
+# Create this secret in each namespace that pulls from the Gitea registry.
+# Replace <TOKEN> with a valid Gitea access token (scopes: read:repository, read:package, write:package).
+#
+# kubectl create secret docker-registry gitea-registry \
+#   --namespace=<namespace> \
+#   --docker-server=gitea.imcu.ro \
+#   --docker-username=mcimpoesu \
+#   --docker-password=<TOKEN> \
+#   --docker-email=mihai@imcu.ro
+#
+# Present in namespaces: default, games, randomly, gitea (if needed)
+#
+# To generate a new Gitea token:
+#   kubectl exec -n gitea deploy/gitea -- gitea admin user generate-access-token \
+#     --username mcimpoesu --token-name "<name>" --scopes "read:repository,write:package,read:package"

cluster-config/namespaces.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: games
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: randomly