rig major updates

rig/ctrl/env.d/mirror.env.example

@@ -0,0 +1,21 @@
+# EXAMPLE PROFILE (optional): copy to mirror.env, then PROFILE=mirror; overlays the defaults.
+# mirror — images via a pull-through cache of an internal registry, TLS and metrics addons.
+# A profile says how this machine reaches the world; what runs is an overlay's business.
+# Notes: docs/notes/env.md
+
+PROFILE_NAME=mirror
+K8S_VERSION=v1_36
+ADDONS="metallb cert-manager metrics-server"
+REGISTRY_MODE=mirror
+INGRESS_MODE=hostport
+DNS_MODE=hosts
+
+# Ports derive from the directory name by default (see ctrl/ports.sh).
+# Real ports only if this is the ONLY environment and nothing owns :80; `make check` tests it.
+# HTTP_PORT=80
+# HTTPS_PORT=443
+
+# Set these in ctrl/.env (gitignored), not here:
+#   REGISTRY_REMOTE_URL=https://registry.internal.example/api/docker/docker-virtual
+#   REGISTRY_USER / REGISTRY_PASSWORD
+#   REGISTRY_CA_FILE=/path/to/internal-root-ca.crt