T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/externaldns/README.md

@@ -0,0 +1,32 @@
+# platform/externaldns
+
+**ExternalDNS** — automatic public DNS records for `public` services (Cloudflare).
+
+- **Spec:** [docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
+  (ExternalDNS is named in [docs/01](../../../home-network-k3s/docs/01-architecture-overview.md); no
+  dedicated ADR)
+- **Serves:** R-DNS-01/02/03
+- **Owner:** WS-NET (token from WS-SEC)
+
+## What this stub is
+
+Flux `HelmRelease` watching Gateway/HTTPRoute + Service resources, publishing
+`<service>.home.keithjackson.dev` records in Cloudflare from declared intent (no manual record
+editing, R-DNS-02).
+
+## Split-horizon note (docs/09)
+
+A wildcard `*.keithjackson.dev` matches only one label deep, so `<svc>.home.keithjackson.dev` needs
+its own record. **`internal` services need NO public record** — PiHole resolves them to the internal
+Gateway VIP (split-horizon). ExternalDNS manages **`public`** services' records only.
+
+## Secrets
+
+Cloudflare API token referenced **by name** (`cloudflare-api-token`, shared with cert-manager),
+**SOPS-encrypted** (WS-SEC, OQ-4).
+
+## TODO (later phases)
+
+- **Phase 2 (WS-NET):** confirm `gateway-httproute` source; prove an auto record for a test route
+  (R-DNS-02, Phase-2 exit gate).
+- **Phase 6 (WS-APPS):** PiHole provides the internal split-horizon answers as it onboards.