feat(sol): add public edge ingress and tls

bootstrap/gitea-actions/README.md

@@ -16,7 +16,8 @@ This module bootstraps a single organization-scoped Gitea Actions runner for `tr
 1. Prepare the org registration token secret in `gitea-actions`.
 2. Apply the kustomize module on `sol`.
 3. Create or refresh the deployer kubeconfig and sync it to the `trade-next` org secrets.
-4. Push a workflow to `trade-gitops` and let the runner execute deployment jobs.
+4. Create or refresh the SSH key secret `SOL_SSH_PRIVATE_KEY_B64` for host-side automation.
+5. Push workflows to `trade-next` repositories and let the runner execute deployment jobs.
 
 ## Bootstrap Commands
 
@@ -24,6 +25,7 @@ From the repository root:
 
 ```bash
 ./bootstrap/gitea-actions/scripts/bootstrap-sol.sh
+./bootstrap/gitea-actions/scripts/sync-sol-ssh-org-secret.sh
 ```
 
 ## Notes

bootstrap/gitea-actions/scripts/sync-sol-ssh-org-secret.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ORG="${ORG:-trade-next}"
+SECRET_NAME="${SECRET_NAME:-SOL_SSH_PRIVATE_KEY_B64}"
+GITEA_URL="${GITEA_URL:-https://gitea.mpabi.pl}"
+GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-/home/user/dev/mcp/tools/tokens/gitea.token}"
+SOL_SSH_KEY="${SOL_SSH_KEY:-/home/user/dev/mcp/keys/mpabi/mevnode_mcp}"
+
+gitea_token() {
+  cut -d: -f2- "$GITEA_TOKEN_FILE" | head -n1 | tr -d '[:space:]'
+}
+
+API_TOKEN="$(gitea_token)"
+if [ -z "$API_TOKEN" ]; then
+  echo "Gitea API token is empty" >&2
+  exit 1
+fi
+
+if [ ! -f "$SOL_SSH_KEY" ]; then
+  echo "Missing SSH key: $SOL_SSH_KEY" >&2
+  exit 1
+fi
+
+KEY_B64="$(base64 -w0 "$SOL_SSH_KEY")"
+PAYLOAD="$(jq -nc --arg data "$KEY_B64" --arg description "base64-encoded SSH key for sol host automation" '{data:$data,description:$description}')"
+
+curl -fsS \
+  -X PUT \
+  -H "Authorization: token ${API_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "$PAYLOAD" \
+  "${GITEA_URL}/api/v1/orgs/${ORG}/actions/secrets/${SECRET_NAME}" \
+  >/dev/null
+
+echo "Organization secret ${ORG}/${SECRET_NAME} updated"