- Use Podman (daemonless) instead of Docker for building images - kubeconfig stored as Gitea secret KUBECONFIG_B64 - RBAC: hugo-deployer SA for k8s API access - Gitea Registry enabled for container storage
- Enable Gitea Container Registry - Dockerfile: nginx:alpine serving hugo public/ - Gitea Actions: build & push image + deploy to k3s - k8s manifests: namespace hugo, deployment, service, ingress - RBAC: allow runner to update deployments in hugo ns - .gitignore: add public/ (CI builds it)