chore: initial infrastructure scaffold

Kustomize base + overlays for the full Sunbeam k3s stack:
- base/mesh      — Linkerd edge (crds + control-plane + viz)
- base/ingress   — custom Pingora edge proxy
- base/ory       — Kratos 0.60.1 + Hydra 0.60.1 + login-ui
- base/data      — CloudNativePG 0.27.1, Valkey 8, OpenSearch 2
- base/storage   — SeaweedFS master + volume + filer (S3 on :8333)
- base/lasuite   — Hive sync daemon + La Suite app placeholders
- base/media     — LiveKit livekit-server 1.9.0
- base/devtools  — Gitea 12.5.0 (external PG + Valkey)
overlays/local   — sslip.io domain, mkcert TLS, Lima hostPort
overlays/production — stub (TODOs for sunbeam.pt values)
scripts/         — local-up/down/certs/urls helpers
justfile         — up / down / certs / urls targets

overlays/local/kustomization.yaml

@@ -0,0 +1,37 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Local dev overlay — targets Lima VM running k3s on macOS
+# Deploy with: kubectl apply -k overlays/local/
+
+resources:
+  - ../../base/mesh
+  - ../../base/ingress
+  - ../../base/ory
+  - ../../base/data
+  - ../../base/storage
+  - ../../base/lasuite
+  - ../../base/media
+  - ../../base/devtools
+
+patches:
+  # sslip.io domain suffix derived from Lima VM IP
+  - path: values-domain.yaml
+    target:
+      kind: ConfigMap
+      name: pingora-config
+
+  # Disable rustls-acme; mount mkcert cert; enable hostPort for Lima
+  - path: values-pingora.yaml
+    target:
+      kind: Deployment
+      name: pingora
+
+  # Swap redirect URIs to *.sslip.io for Kratos and Hydra
+  - path: values-ory.yaml
+    target:
+      kind: ConfigMap
+      labelSelector: "app.kubernetes.io/part-of=ory"
+
+  # Apply §10.7 memory limits across all Deployments
+  - path: values-resources.yaml

overlays/local/values-domain.yaml

@@ -0,0 +1,21 @@
+# Patch: replace DOMAIN_SUFFIX placeholder with <LIMA_IP>.sslip.io
+# in the Pingora ConfigMap's routing table.
+#
+# How to apply: the local-up.sh script calls:
+#   LIMA_IP=$(limactl shell sunbeam hostname -I | awk '{print $1}')
+#   sed "s/DOMAIN_SUFFIX/${LIMA_IP}.sslip.io/g" overlays/local/values-domain.yaml | kubectl apply -f -
+#
+# Or use kustomize's replacements feature if the IP is known at kustomize time.
+#
+# This is a strategic merge patch on the pingora-config ConfigMap.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pingora-config
+  namespace: ingress
+data:
+  # DOMAIN_SUFFIX is substituted at deploy time by local-up.sh.
+  # The local overlay domain is: <LIMA_IP>.sslip.io
+  # Example: 192.168.5.2.sslip.io
+  domain-suffix: "LIMA_IP.sslip.io"

overlays/local/values-ory.yaml

@@ -0,0 +1,27 @@
+# Patch: Ory redirect URIs → sslip.io hostnames for local dev.
+# Applied as a strategic merge patch over the rendered Kratos/Hydra ConfigMaps.
+#
+# DOMAIN_SUFFIX is substituted by local-up.sh at deploy time.
+# Production overlay uses sunbeam.pt.
+
+# Kratos selfservice URLs
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kratos-config
+  namespace: ory
+data:
+  selfservice.default_browser_return_url: "https://auth.DOMAIN_SUFFIX/"
+  selfservice.flows.login.ui_url: "https://auth.DOMAIN_SUFFIX/login"
+  selfservice.flows.registration.ui_url: "https://auth.DOMAIN_SUFFIX/registration"
+  selfservice.flows.recovery.ui_url: "https://auth.DOMAIN_SUFFIX/recovery"
+  selfservice.flows.settings.ui_url: "https://auth.DOMAIN_SUFFIX/settings"
+  selfservice.allowed_return_urls: |
+    - https://auth.DOMAIN_SUFFIX/
+    - https://docs.DOMAIN_SUFFIX/
+    - https://meet.DOMAIN_SUFFIX/
+    - https://drive.DOMAIN_SUFFIX/
+    - https://mail.DOMAIN_SUFFIX/
+    - https://chat.DOMAIN_SUFFIX/
+    - https://people.DOMAIN_SUFFIX/
+    - https://src.DOMAIN_SUFFIX/

overlays/local/values-pingora.yaml

@@ -0,0 +1,30 @@
+# Patch: local Pingora overrides
+# - Disables rustls-acme (ACME negotiation not needed locally)
+# - Mounts mkcert wildcard cert from the pingora-tls Secret
+# - Exposes TURN relay range as hostPort on the Lima VM
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pingora
+  namespace: ingress
+spec:
+  template:
+    spec:
+      containers:
+        - name: pingora
+          env:
+            - name: ACME_ENABLED
+              value: "false"
+          ports:
+            # Expose full TURN relay range as hostPort so the Lima VM forwards UDP
+            - name: turn-relay-start
+              containerPort: 49152
+              hostPort: 49152
+              protocol: UDP
+            - name: turn-relay-end
+              containerPort: 49252
+              hostPort: 49252
+              protocol: UDP
+          # TLS cert comes from mkcert Secret created by scripts/local-certs.sh
+          # Secret name: pingora-tls, keys: tls.crt / tls.key

overlays/local/values-resources.yaml

@@ -0,0 +1,94 @@
+# Patch: apply §10.7 memory limits to all Deployments in the local overlay.
+# These are intentionally tight to stay within the 12 GB Lima VM budget.
+#
+# Applied as a strategic merge patch. Each stanza targets one Deployment by name.
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pingora
+  namespace: ingress
+spec:
+  template:
+    spec:
+      containers:
+        - name: pingora
+          resources:
+            limits:
+              memory: 64Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: valkey
+  namespace: data
+spec:
+  template:
+    spec:
+      containers:
+        - name: valkey
+          resources:
+            limits:
+              memory: 64Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opensearch
+  namespace: data
+spec:
+  template:
+    spec:
+      containers:
+        - name: opensearch
+          resources:
+            limits:
+              memory: 512Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: seaweedfs-filer
+  namespace: storage
+spec:
+  template:
+    spec:
+      containers:
+        - name: filer
+          resources:
+            limits:
+              memory: 256Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: login-ui
+  namespace: ory
+spec:
+  template:
+    spec:
+      containers:
+        - name: login-ui
+          resources:
+            limits:
+              memory: 64Mi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hive
+  namespace: lasuite
+spec:
+  template:
+    spec:
+      containers:
+        - name: hive
+          resources:
+            limits:
+              memory: 64Mi

overlays/production/kustomization.yaml

@@ -0,0 +1,29 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Production overlay — targets Scaleway Elastic Metal (Paris)
+# Deploy with: kubectl apply -k overlays/production/
+# TODO: fill in all production values before first production deploy
+
+resources:
+  - ../../base/mesh
+  - ../../base/ingress
+  - ../../base/ory
+  - ../../base/data
+  - ../../base/storage
+  - ../../base/lasuite
+  - ../../base/media
+  - ../../base/devtools
+
+patches:
+  # TODO: set domain to sunbeam.pt
+  # - path: values-domain.yaml
+
+  # TODO: enable rustls-acme + Let's Encrypt, bind to public IP
+  # - path: values-pingora.yaml
+
+  # TODO: set OIDC redirect URIs to https://*.sunbeam.pt/...
+  # - path: values-ory.yaml
+
+  # TODO: set production resource limits (64 GB server)
+  # - path: values-resources.yaml