ci(deploy): split runtime by k8s/active marker

services marked k8s/active are applied via kubectl; the rest via docker
compose. inactive services with k8s/ keep only routing manifests
(external Services, EndpointSlices, Ingresses) to reach docker backends.
headscale/nextcloud routing moved to k8s/routing/.

validations: compose config --quiet + kubectl apply --dry-run=client.
namespace manifests applied first. pull_policy:build stacks get
build+push before up so the registry image stays fresh.

headscale/k8s/routing/external-service.yaml

@@ -0,0 +1,86 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-server-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 8080
+      targetPort: 18080
+      name: http
+    - port: 9090
+      targetPort: 19090
+      name: metrics
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headscale-server-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headscale-server-external
+addressType: IPv4
+ports:
+  - port: 18080
+    protocol: TCP
+    name: http
+  - port: 19090
+    protocol: TCP
+    name: metrics
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-ui-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 80
+      targetPort: 10080
+      name: http
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headscale-ui-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headscale-ui-external
+addressType: IPv4
+ports:
+  - port: 10080
+    protocol: TCP
+    name: http
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headplane-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 3000
+      targetPort: 13000
+      name: http
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headplane-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headplane-external
+addressType: IPv4
+ports:
+  - port: 13000
+    protocol: TCP
+    name: http
+endpoints:
+  - addresses:
+      - "192.168.88.100"

headscale/k8s/routing/ingress.yaml

@@ -0,0 +1,104 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: headplane-prefix
+  namespace: headscale
+spec:
+  addPrefix:
+    prefix: "/admin"
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.forust.xyz`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 8080
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headscale-ui-external
+          port: 80
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 9090
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headplane-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hp.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: Host(`hp.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 8080
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headscale-ui-external
+          port: 80
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/metrics`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 9090
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headplane-local
+  namespace: headscale
+spec:
+  routes:
+    - match: Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: (Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000