feat(homepage): apex landing dashboard at home.keithjackson.dev

Deploy Homepage (gethomepage) as the apex landing dashboard aggregating
links to cluster services, in its OWN non-gating post-platform Flux
Kustomization (clusters/base/homepage.yaml, dependsOn platform-config,
wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate
the platform chain.

- platform/homepage/: plain manifests (ns, config ConfigMap, Deployment,
  Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod,
  HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress).
- gateway.yaml: add https-apex + http-apex-redirect listeners for the bare
  apex (the *.home wildcard listener does NOT match it). Apex is already a
  SAN on the wildcard cert — no new Certificate.
- Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the
  Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status
  as all other forward-auth apps). Flagged as PM follow-up.

Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/homepage.yaml

@@ -0,0 +1,42 @@
+---
+# Flux Kustomization: Homepage landing dashboard — reconciles ./platform/homepage.
+#
+# POST-PLATFORM TIER (dependsOn platform-config). Homepage is a LEAF landing UI at the apex
+# home.keithjackson.dev. It depends on the trusted wildcard TLS cert + the shared Gateway (incl. the
+# `https-apex` listener) + split-horizon DNS — all brought up by `platform` (controllers) and
+# `platform-config` (the wildcard Certificate, cilium L2 VIP, Gateway). It therefore MUST NOT live in
+# the gating `platform` tier: a UI whose pod can be unhealthy would keep `platform` not-Ready, and
+# while `platform` is not-Ready NOTHING downstream reconciles — the exact incident behind the
+# headlamp/oauth2-proxy moves (DECISIONS-LOG: "Headlamp gating stall"). Same lesson, same fix: a leaf
+# that can be legitimately unhealthy reconciles in its OWN post-platform Kustomization.
+#
+# NON-GATING (wait:false): nothing in the graph dependsOn homepage (apps waves gate on
+# platform-config, not on this), and a dashboard pod can be long-not-Ready during a cold start.
+# wait:false guarantees its health can NEVER gate anything, even if a future resource is (mistakenly)
+# pointed dependsOn it.
+#
+# NO SOPS decryption stanza: this component carries no encrypted Secret (plain manifests + a config
+# ConfigMap with no API keys), so — unlike headlamp/oauth2-proxy — clusters/dev does NOT patch it.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: homepage
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  prune: true
+  wait: false
+  dependsOn:
+    - name: platform-config   # wildcard TLS + Gateway (incl. https-apex listener) + split-horizon VIP first
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./platform/homepage
+  # Homepage references no ${VARS} today; the substitution is retained for parity with the other
+  # tiers / future overlay knobs.
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-vars

clusters/base/kustomization.yaml

@@ -26,4 +26,8 @@ resources:
   # sit in the gating `platform` tier, where its unhealth stalled platform-config + oauth2-proxy +
   # every apps wave/vm on "dependency not ready" (DECISIONS-LOG: "Headlamp gating stall").
   - headlamp.yaml        # Flux Kustomization -> ./platform/headlamp (dependsOn platform-config)
+  # Homepage apex landing dashboard — POST-platform tier (dependsOn platform-config, wait:false).
+  # A leaf UI at home.keithjackson.dev; same non-gating rationale as headlamp/oauth2-proxy (a UI must
+  # never gate the platform chain). Carries no SOPS secret, so clusters/dev adds no decryption patch.
+  - homepage.yaml        # Flux Kustomization -> ./platform/homepage (dependsOn platform-config)
   - cluster-vars.yaml    # overlay knob surface (base defaults)