update to argo deploy method

README.md

@@ -33,9 +33,45 @@ sacrificing performance.
 
 ## Implementation
 - **Hugo**: Converts Markdown files into static HTML/CSS/JS files.
-- **Gitea Actions**: Automates the build process and creates Docker images.
+- **Gitea Actions**: Builds amd64/arm64 images and records the exact image digest
+  in the separate GitOps repository.
+- **Argo CD**: Watches that Git commit and reconciles the Kubernetes deployment.
 - **Kubernetes Cluster**: Serves the static files to users.
 
+## GitOps deployment
+
+The workflow in [`.gitea/workflows/build-docker-images.yml`](.gitea/workflows/build-docker-images.yml)
+keeps building and publishing `tea.ahmza.com/ahmza/blog-ahmza-com`. Instead of
+connecting to NetBird and invoking `kubectl`, it commits the published image's
+immutable digest to `apps/blog-ahmza-com/deployment.yaml` in
+[`ahmza.com/k8s-starter-pack`](https://tea.ahmza.com/ahmza.com/k8s-starter-pack).
+Argo CD then performs the rollout; CI success alone is not confirmation that the
+cluster has finished deploying.
+
+Configure these Gitea Actions secrets in this source repository:
+
+- `GITEATOKEN`: the existing registry-push credential.
+- `GITOPS_TOKEN`: a separate least-privilege bot PAT with read/write access to
+  `ahmza.com/k8s-starter-pack`, including permission to push to `main`.
+
+Commit/push the GitOps app manifests **before** enabling this workflow: the
+Deployment file must already exist remotely. Once the migration is verified,
+remove the old `KUBE_CONFIG`, `NETBIRD_SETUP_KEY`, and `NETBIRD_URL` secrets only
+if no other workflows use them. No Kubernetes credentials are needed by this
+workflow. The runner still needs HTTPS access to Gitea and the registry.
+
+The full first-sync, routing, certificate, and rollback checklist is in
+[`docs/13-blog-gitops.md`](https://tea.ahmza.com/ahmza.com/k8s-starter-pack/src/branch/main/docs/13-blog-gitops.md)
+in the GitOps repository. The older [Caddy examples](docs/caddy-reverse-proxy.md)
+are standalone deployment references, not extra components to deploy alongside
+the new ingress-nginx manifests.
+
+Test the standard-library-only image updater locally with:
+
+```sh
+python3 -m unittest discover -s .gitea/tests -v
+```
+
 ## To-Do List
 - [x] Migrate to Kubernetes
 - [x] Migrate to Blowfish theme