feat(infra): data, storage, devtools, and ory layer updates

- data: CNPG cluster tuning, OpenBao values, OpenSearch deployment fixes,
  OpenSearch PVC, barman vault secret for S3 backup credentials
- storage: SeaweedFS filer updates (s3.json via secret subPath), PVC for
  filer persistent storage
- devtools: Gitea values (SSH service, custom theme), gitea-theme-cm ConfigMap
- ory: add kratos-selfservice-urls.yaml for self-service flow URLs
- media: LiveKit values updated (TURN config, STUN, resource limits)
- vso: kustomization cleanup

base/data/barman-vault-secret.yaml

@@ -0,0 +1,39 @@
+---
+# VaultAuth for VSO to authenticate in the data namespace.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vso-auth
+  namespace: data
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: vso
+    serviceAccount: default
+---
+# Scaleway S3 credentials for CNPG barman backups.
+# OpenBao KV path: secret/scaleway-s3 (keys: access-key-id, secret-access-key)
+# Seeded by: sunbeam seed (reads from scw CLI config)
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: barman-s3-creds
+  namespace: data
+spec:
+  vaultAuthRef: vso-auth
+  mount: secret
+  type: kv-v2
+  path: scaleway-s3
+  refreshAfter: 30s
+  destination:
+    name: barman-s3-creds
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      templates:
+        ACCESS_KEY_ID:
+          text: "{{ index .Secrets \"access-key-id\" }}"
+        ACCESS_SECRET_KEY:
+          text: "{{ index .Secrets \"secret-access-key\" }}"

base/data/kustomization.yaml

@@ -10,7 +10,9 @@ resources:
   - valkey-service.yaml
   - opensearch-deployment.yaml
   - opensearch-service.yaml
+  - opensearch-pvc.yaml
   - openbao-keys-placeholder.yaml
+  - barman-vault-secret.yaml
 
 helmCharts:
   # helm repo add cnpg https://cloudnative-pg.github.io/charts

base/data/openbao-values.yaml

@@ -17,6 +17,9 @@ server:
     registry: quay.io
     repository: openbao/openbao
 
+  # Disable anti-affinity — single-node cluster.
+  affinity: ""
+
   standalone:
     enabled: true
     config: |

base/data/opensearch-deployment.yaml

@@ -42,3 +42,10 @@ spec:
             requests:
               memory: 768Mi
               cpu: 100m
+          volumeMounts:
+            - name: data
+              mountPath: /usr/share/opensearch/data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: opensearch-data

base/data/opensearch-pvc.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: opensearch-data
+  namespace: data
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 10Gi

base/data/postgres-cluster.yaml

@@ -16,8 +16,9 @@ spec:
     initdb:
       database: postgres
       owner: postgres
-      secret:
-        name: postgres-superuser
+      # No `secret` field — CNPG auto-generates a random superuser password
+      # and stores it in the `postgres-superuser` Secret. sunbeam seed reads
+      # that Secret to configure the OpenBao database secrets engine.
       postInitSQL:
         # Create all 10 logical databases and their owners.
         # Passwords are set by the seed-secrets script via ALTER USER after init.