T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/externaldns/README.md

@@ -0,0 +1,32 @@
+# platform/externaldns
+
+**ExternalDNS** — automatic public DNS records for `public` services (Cloudflare).
+
+- **Spec:** [docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
+  (ExternalDNS is named in [docs/01](../../../home-network-k3s/docs/01-architecture-overview.md); no
+  dedicated ADR)
+- **Serves:** R-DNS-01/02/03
+- **Owner:** WS-NET (token from WS-SEC)
+
+## What this stub is
+
+Flux `HelmRelease` watching Gateway/HTTPRoute + Service resources, publishing
+`<service>.home.keithjackson.dev` records in Cloudflare from declared intent (no manual record
+editing, R-DNS-02).
+
+## Split-horizon note (docs/09)
+
+A wildcard `*.keithjackson.dev` matches only one label deep, so `<svc>.home.keithjackson.dev` needs
+its own record. **`internal` services need NO public record** — PiHole resolves them to the internal
+Gateway VIP (split-horizon). ExternalDNS manages **`public`** services' records only.
+
+## Secrets
+
+Cloudflare API token referenced **by name** (`cloudflare-api-token`, shared with cert-manager),
+**SOPS-encrypted** (WS-SEC, OQ-4).
+
+## TODO (later phases)
+
+- **Phase 2 (WS-NET):** confirm `gateway-httproute` source; prove an auto record for a test route
+  (R-DNS-02, Phase-2 exit gate).
+- **Phase 6 (WS-APPS):** PiHole provides the internal split-horizon answers as it onboards.

platform/externaldns/helmrelease.yaml

@@ -0,0 +1,45 @@
+---
+# ExternalDNS — publishes public DNS records for `public` services automatically (docs/09, R-DNS-02).
+# Watches Gateway/HTTPRoute (+Service); manages records in Cloudflare. Phase 0 STUB.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-dns
+  namespace: external-dns
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: external-dns
+      version: ">=1.15.0 <1.16.0"   # TODO(WS-NET): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: external-dns
+        namespace: external-dns
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    provider:
+      name: cloudflare
+    # Watch Gateway API routes (Cilium Gateway) + Services. docs/09: records rendered from intent.
+    sources:
+      - gateway-httproute
+      - service
+    # Only manage the platform zone. `internal` services need no public record (split-horizon via
+    # PiHole) — docs/09 "DNS record depth".
+    domainFilters:
+      - "home.keithjackson.dev"
+    policy: sync            # create + update + delete records as services come and go
+    # Cloudflare API token: SOPS-encrypted secret, referenced BY NAME only (OQ-4, ADR-0007).
+    env:
+      - name: CF_API_TOKEN
+        valueFrom:
+          secretKeyRef:
+            name: cloudflare-api-token
+            key: api-token
+    # TODO(WS-NET, Phase 2): confirm gateway-httproute source wiring; prove a record appears
+    #   automatically for a test route (R-DNS-02, Phase-2 exit gate).

platform/externaldns/helmrepository.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-dns
+  namespace: external-dns
+spec:
+  interval: 1h
+  url: https://kubernetes-sigs.github.io/external-dns/

platform/externaldns/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml

platform/externaldns/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-dns

platform/externaldns/values.yaml

@@ -0,0 +1,8 @@
+# ExternalDNS Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
+#
+# provider.name: cloudflare
+# sources: [gateway-httproute, service]        # Cilium Gateway API + Services (docs/09)
+# domainFilters: [home.keithjackson.dev]        # only the platform zone
+# policy: sync                                  # create/update/delete records with services
+# Cloudflare token: SOPS-encrypted `cloudflare-api-token` (WS-SEC, OQ-4) — name only.
+# NOTE: `internal` services need NO public record (PiHole split-horizon, docs/09).