feat: migrate basicstack.org deployment to stack repo

Move basicstack.org deployment manifests from basicstack.org/k8s to
stack.basicstack.de/apps/basicstack-org to centralize infrastructure
configuration and use Harbor registry.

Changes:
- Created apps/basicstack-org/ with deployment manifests
- Updated Argo CD app to point to stack.basicstack.de repo
- Deployment now uses Harbor registry at 10.106.73.119:5000
- Set imagePullPolicy: Always for continuous deployment

Related: DEV-336

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/app-basicstack-org.yaml

@@ -6,9 +6,9 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/basicstack.org.git
+    repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git
     targetRevision: main
-    path: k8s
+    path: apps/basicstack-org
   destination:
     server: https://kubernetes.default.svc
     namespace: basicstack-web

apps/basicstack-org/README.md

@@ -0,0 +1,34 @@
+# BasicStack.org Web Application
+
+This directory contains the Kubernetes deployment manifests for the BasicStack.org frontend website.
+
+## Architecture
+
+- **Application**: Nuxt 3 + Vue 3 frontend
+- **Container Registry**: Harbor at `10.106.73.119:5000`
+- **Image Name**: `basicstack-web`
+- **Namespace**: `basicstack-web`
+
+## Components
+
+- `configmap.yaml` - Environment configuration
+- `deployment.yaml` - Application deployment and service
+- `ingress.yaml` - Traefik ingress rules for basicstack.org and www.basicstack.org
+
+## CI/CD
+
+The application is built and pushed to Harbor by the Forgejo Actions workflow in the [basicstack.org repository](https://forgejo.basicstack.de/basicstack/basicstack.org).
+
+The workflow:
+1. Builds the Docker image from the Dockerfile
+2. Pushes to Harbor registry at `10.106.73.119:5000/basicstack-web:latest`
+3. Argo CD automatically syncs the deployment when new images are available
+
+## Image Pull Policy
+
+The deployment uses `imagePullPolicy: Always` to ensure the latest image is pulled on each pod restart, enabling continuous deployment of new builds.
+
+## Domains
+
+- Primary: https://basicstack.org
+- Redirect: https://www.basicstack.org → https://basicstack.org

apps/basicstack-org/configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: basicstack-web-config
+  namespace: basicstack-web
+data:
+  DIRECTUS_URL: "https://directus.basicstack.de"
+  SITE_URL: "https://basicstack.org"
+  NODE_ENV: "production"

apps/basicstack-org/deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: basicstack-web
+  namespace: basicstack-web
+  labels:
+    app: basicstack-web
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: basicstack-web
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: basicstack-web
+    spec:
+      containers:
+        - name: basicstack-web
+          image: 10.106.73.119:5000/basicstack-web:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3000
+              name: http
+          envFrom:
+            - configMapRef:
+                name: basicstack-web-config
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 15
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: basicstack-web
+  namespace: basicstack-web
+spec:
+  selector:
+    app: basicstack-web
+  ports:
+    - port: 80
+      targetPort: 3000
+      name: http

apps/basicstack-org/ingress.yaml

@@ -0,0 +1,50 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: basicstack-web
+  namespace: basicstack-web
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: basicstack-web-redirect@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - basicstack.org
+        - www.basicstack.org
+      secretName: basicstack-org-tls
+  rules:
+    - host: basicstack.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: basicstack-web
+                port:
+                  number: 80
+    - host: www.basicstack.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: basicstack-web
+                port:
+                  number: 80
+---
+# Redirect www to non-www
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect
+  namespace: basicstack-web
+spec:
+  redirectRegex:
+    regex: "^https://www\\.basicstack\\.org/(.*)"
+    replacement: "https://basicstack.org/${1}"
+    permanent: true