feat: add hugo static site deployment

clusters/homelab/apps/hugo.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hugo
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./clusters/homelab/apps/hugo
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

clusters/homelab/apps/hugo/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hugo
+  namespace: hugo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hugo
+  template:
+    metadata:
+      labels:
+        app: hugo
+    spec:
+      initContainers:
+        - name: artifact-fetch
+          image: ghcr.io/fluxcd/flux-cli:v2.8.5
+          env:
+            - name: REGISTRY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: hugo-registry
+                  key: token
+          command:
+            - sh
+            - -c
+            - |
+              flux pull artifact oci://forgejo.net-scope.org/hans/hugo-site:latest \
+                --output=/public \
+                --creds=hans:${REGISTRY_TOKEN}
+          volumeMounts:
+            - name: public
+              mountPath: /public
+      containers:
+        - name: nginx
+          image: nginx:alpine
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: public
+              mountPath: /usr/share/nginx/html
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "10m"
+            limits:
+              memory: "64Mi"
+              cpu: "100m"
+      volumes:
+        - name: public
+          emptyDir: {}

clusters/homelab/apps/hugo/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - secret.sops.yaml
+  - deployment.yaml
+  - service.yaml

clusters/homelab/apps/hugo/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hugo

clusters/homelab/apps/hugo/secret.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: ENC[AES256_GCM,data:rJQ=,iv:bi/botBQBrdFbDnz7mPo+4Z2KC83phpX9QwSWEd7ocw=,tag:Mb2Bc8A0/kPf+E76C3OPlA==,type:str]
+kind: ENC[AES256_GCM,data:wqikSiKu,iv:IRgsTcmRYllYvv32z7ap0MVm3XxbFHLmhEZNB1yYfxo=,tag:J7SaIlHKAK96yOgQ4/TG/w==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:tuyp95XjnJ7hmselZQ==,iv:Qdb1EA8uQaWzHE1xcHvf0ht+iyHmya9AaoNsUVeVCnw=,tag:2tYxvILbN41gOA4jYqAGcQ==,type:str]
+    namespace: ENC[AES256_GCM,data:VkkF3Q==,iv:Kegn4sgJEllCpAbn9GMzUknaQIC96ke608qsBNfjgQ4=,tag:cdZv3OkvkPDjFGCKhwuJ8Q==,type:str]
+stringData:
+    token: ENC[AES256_GCM,data:dWN3baAcMkqhWndpz9L5ZG8HvA==,iv:poc+qXxeloPeg0YlMBbnc74GKDg0KsF5bMIZIFQ4XM0=,tag:+2w+RfVShElHQqANpm8xdQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWKzNIc1RXZng0N3NiM2xE
+            eTA5cFhJMUZRbW4wK3pITmE0OEFZaE1DY2k4CjZtOFptUWhQaTZZOS8rb2dGOEVN
+            N2dYMDlnczlPRWJXcWszVWc5dDVZbVUKLS0tIFA2ODYwczRCRk5CaHA5NW9Nd3JU
+            SWM2K2VNRDRaRmpjY3pGdVZjbEM4ZlkKcJ2Ytx9kzQaHbuw8saYIUwwojCqxiOQc
+            gIQe/FlvZ0m8Azfr5BL5NKUcWvMYSQo6si7lngRpYBDIGw/VY6g7AA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-19T17:37:29Z"
+    mac: ENC[AES256_GCM,data:9tj7ezR4Pmp/336Dos7O0znnGQSC5YqHDdukpstN7Ep6dJXB4rStWqgtQgJklVtcqZ8VB2xxqvzI/P945YxLGeWf9EsXpzF2q+eSD94JUPTcRIumaq0HiSWjK74w3MyZFO1SKWOlYC9xpUsrsF4elILyhnnraY+bY/DUpAdKWgA=,iv:oD2HeT+w0Zhzo0w5UzXC1yEsgXiandiMP2JWmmRD79Q=,tag:zqrtW47PDP6tFrXWvzMxVQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

clusters/homelab/apps/hugo/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: hugo
+  namespace: hugo
+spec:
+  selector:
+    app: hugo
+  ports:
+    - port: 80
+      targetPort: 80