T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/externaldns/helmrelease.yaml

@@ -0,0 +1,45 @@
+---
+# ExternalDNS — publishes public DNS records for `public` services automatically (docs/09, R-DNS-02).
+# Watches Gateway/HTTPRoute (+Service); manages records in Cloudflare. Phase 0 STUB.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-dns
+  namespace: external-dns
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: external-dns
+      version: ">=1.15.0 <1.16.0"   # TODO(WS-NET): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: external-dns
+        namespace: external-dns
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    provider:
+      name: cloudflare
+    # Watch Gateway API routes (Cilium Gateway) + Services. docs/09: records rendered from intent.
+    sources:
+      - gateway-httproute
+      - service
+    # Only manage the platform zone. `internal` services need no public record (split-horizon via
+    # PiHole) — docs/09 "DNS record depth".
+    domainFilters:
+      - "home.keithjackson.dev"
+    policy: sync            # create + update + delete records as services come and go
+    # Cloudflare API token: SOPS-encrypted secret, referenced BY NAME only (OQ-4, ADR-0007).
+    env:
+      - name: CF_API_TOKEN
+        valueFrom:
+          secretKeyRef:
+            name: cloudflare-api-token
+            key: api-token
+    # TODO(WS-NET, Phase 2): confirm gateway-httproute source wiring; prove a record appears
+    #   automatically for a test route (R-DNS-02, Phase-2 exit gate).