feat(k8s): add K8s manifests for all homelab services

traefik, gitea, adguard, nextcloud, errorpages, homepages,
uptime-kuma, kener, checkmk, headscale, dockmon, metube,
downtify, portainer, netronome, userbot

Includes Helm values, deployments, services, ingress routes,
configmaps, secrets (placeholders), postgres statefulsets,
kustomize overlays, and Traefik dynamic configuration.

dockmon/k8s/dockmon.yaml

@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dockmon-service
+  namespace: dockmon
+spec:
+  selector:
+    app: dockmon
+  ports:
+  - port: 443
+    targetPort: 443
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dockmon-deployment
+  namespace: dockmon
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dockmon
+  template:
+    metadata:
+      labels:
+        app: dockmon
+    spec:
+      containers:
+      - name: dockmon
+        image: darthnorse/dockmon:latest
+        ports:
+        - containerPort: 443
+        volumeMounts:
+        - name: data
+          mountPath: /app/data
+        - name: docker-sock
+          mountPath: /var/run/docker.sock
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 443
+            scheme: HTTPS
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 10
+          failureThreshold: 3
+        resources:
+          requests:
+            memory: "512Gi"
+            cpu: "200m"
+          limits:
+            memory: "2Gi"
+            cpu: "1500m "
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: dockmon-data-pvc
+      - name: docker-sock
+        hostPath:
+          path: /var/run/docker.sock
+          type: Socket
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dockmon-data-pvc
+  namespace: dockmon
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

dockmon/k8s/ingress.yaml

@@ -0,0 +1,63 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: dockmon-transport
+  namespace: dockmon
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-prod
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dockmon.forust.xyz`)
+    kind: Rule
+    middlewares:
+    - name: security-headers@file
+    services:
+    - name: dockmon-service
+      port: 443
+      serversTransport: dockmon-transport
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-local
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dockmon.workstation.internal`)
+    kind: Rule
+    services:
+    - name: dockmon-service
+      port: 443
+      serversTransport: dockmon-transport
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-dev
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dockmon.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: dockmon-service
+      port: 443
+      serversTransport: dockmon-transport
+  tls:
+    secretName: local-tls

dockmon/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dockmon