ci(deploy): split runtime by k8s/active marker

services marked k8s/active are applied via kubectl; the rest via docker
compose. inactive services with k8s/ keep only routing manifests
(external Services, EndpointSlices, Ingresses) to reach docker backends.
headscale/nextcloud routing moved to k8s/routing/.

validations: compose config --quiet + kubectl apply --dry-run=client.
namespace manifests applied first. pull_policy:build stacks get
build+push before up so the registry image stays fresh.

nextcloud/k8s/routing/external-service.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+spec:
+  ports:
+    - port: 11000
+      targetPort: 11000
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-apache
+addressType: IPv4
+ports:
+  - port: 11000
+    protocol: TCP
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+    conditions:
+      ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+spec:
+  ports:
+    - port: 8888
+      targetPort: 8888
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-aio
+addressType: IPv4
+ports:
+  - port: 8888
+    protocol: TCP
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+    conditions:
+      ready: true

nextcloud/k8s/routing/ingress.yaml

@@ -0,0 +1,73 @@
+# Nextcloud
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-prod
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nextcloud.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: nextcloud-chain@file
+      services:
+        - name: nextcloud-apache
+          port: 11000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-local
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nextcloud.workstation.internal`) || Host(`nextcloud.gigaforust.internal`)
+      kind: Rule
+      middlewares:
+        - name: nextcloud-chain@file
+      services:
+        - name: nextcloud-apache
+          port: 11000
+# ---
+# Nextcloud AIO
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: naio-prod
+#   namespace: nextcloud
+# spec:
+#   entryPoints:
+# - websecure
+# routes:
+#   - match: Host(`naio.forust.xyz`)
+#     kind: Rule
+#     services:
+#       - name: nextcloud-aio
+#         port: 8888
+#         scheme: https
+#         serversTransport: insecure-transport
+# tls:
+#   certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: naio-local
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`naio.workstation.internal`) || Host(`naio.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: nextcloud-aio
+          port: 8888
+          scheme: https
+          serversTransport: insecure-transport

nextcloud/k8s/routing/servers-transport.yaml

@@ -0,0 +1,7 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: insecure-transport
+  namespace: nextcloud
+spec:
+  insecureSkipVerify: true