Split unbound into its own app directory

unbound was bundled inside apps/pihole/ and invisible in the apps/
listing. Now apps/unbound/ (deployment + service + kustomization); it
stays in the pihole namespace, whose Namespace object remains owned by
apps/pihole. No resource changes — server-side dry-run clean (36
resources).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -19,7 +19,8 @@ Each app under `apps/` is a self-contained kustomization
 | searxng | default | searxng.wittyoneoff.com, origin-searxng.wittyoneoff.com |
 | home-assistant | home-assistant | ha.wittyoneoff.com, ha-origin.wittyoneoff.com |
 | nginx | nginx | www.wittyoneoff.com, www.ramonaajj.com |
-| pihole (+unbound) | pihole | admin on :8000 via klipper-lb, DNS on :53 |
+| pihole | pihole | admin on :8000 via klipper-lb, DNS on :53 |
+| unbound | pihole | pi-hole's upstream recursive resolver (ClusterIP only) |
 | unified-streaming | unified-streaming | unified.wittyoneoff.com |
 
 Not in this repo: socktop (own repo + pipeline), rancher/monitoring/logging

apps/pihole/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
   - namespace.yaml
   - storage.yaml
   - deployment-pihole.yaml
-  - deployment-unbound.yaml
   - service.yaml

apps/pihole/service.yaml

@@ -32,22 +32,3 @@ spec:
       targetPort: 67
       nodePort: 31025
       protocol: UDP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: unbound-service
-  namespace: pihole
-spec:
-  type: ClusterIP
-  selector:
-    app: unbound
-  ports:
-    - name: udp-53
-      port: 53
-      targetPort: 53
-      protocol: UDP
-    - name: tcp-53
-      port: 53
-      targetPort: 53
-      protocol: TCP

apps/unbound/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Lives in the pihole namespace (pi-hole's upstream resolver) — the namespace
+# object itself is owned by apps/pihole.
+resources:
+  - deployment.yaml
+  - service.yaml

apps/unbound/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: unbound-service
+  namespace: pihole
+spec:
+  type: ClusterIP
+  selector:
+    app: unbound
+  ports:
+    - name: udp-53
+      port: 53
+      targetPort: 53
+      protocol: UDP
+    - name: tcp-53
+      port: 53
+      targetPort: 53
+      protocol: TCP

kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - apps/home-assistant
   - apps/nginx
   - apps/pihole
+  - apps/unbound
   - apps/unified-streaming