Gitea MCP connector: K8s manifests for public claude.ai integration

Shemot 28:3 — v'asu et bigdei Aharon l'kadesho l'chahano li.
The garments connect the service to those who approach.

- gitea-mcp-deployment.yaml: Official gitea-mcp server in HTTP mode
  Connects to Gitea at 185.19.29.94 via PAT
- gitea-mcp-ingress.yaml: TLS ingress at mcp.shorashim.ch
  cert-manager auto-provisions Let's Encrypt certificate
- gitea-mcp-secret.yaml: Template for Gitea PAT (never committed with value)
- cert-manager-issuer.yaml: Let's Encrypt ClusterIssuer

Architecture: claude.ai → OAuth → mcp.shorashim.ch → Gitea API

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/k8s/gitea-mcp-ingress.yaml

@@ -0,0 +1,37 @@
+# Ingress for Gitea MCP Server — public HTTPS endpoint
+# Routes mcp.shorashim.ch to the gitea-mcp service
+# TLS via cert-manager (Let's Encrypt)
+#
+# Prerequisites:
+# 1. nginx-ingress controller installed
+# 2. cert-manager installed
+# 3. ClusterIssuer letsencrypt-prod applied
+# 4. DNS: mcp.shorashim.ch → Ingress external IP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-mcp
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: gitea-mcp
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - mcp.shorashim.ch
+      secretName: gitea-mcp-tls
+  rules:
+    - host: mcp.shorashim.ch
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitea-mcp
+                port:
+                  number: 8080