# Wave 2 — Loki / Grafana / Promtail (Grafana Helm charts).
# NOTE: loki-values / grafana-values reference secrets (S3 creds, admin password)
# that helmfile used to inject via --set. Under ArgoCD these come from the
# *.enc.yaml SOPS files in the same dir via the SOPS plugin — verify the plugin
# is configured before first sync, or these will render with empty secrets.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: loki
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  project: homelab
  sources:
    - repoURL: https://grafana.github.io/helm-charts
      chart: loki
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/platform/logging/loki-values.yaml
    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: logging
  syncPolicy:
    managedNamespaceMetadata:
      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
      # privileged:true) to tail node logs — default baseline PSS blocks it.
      labels:
        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: grafana
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  project: homelab
  sources:
    - repoURL: https://grafana.github.io/helm-charts
      chart: grafana
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/platform/logging/grafana-values.yaml
    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: logging
  syncPolicy:
    managedNamespaceMetadata:
      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
      # privileged:true) to tail node logs — default baseline PSS blocks it.
      labels:
        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: promtail
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  project: homelab
  sources:
    - repoURL: https://grafana.github.io/helm-charts
      chart: promtail
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/platform/logging/promtail-values.yaml
    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: logging
  syncPolicy:
    managedNamespaceMetadata:
      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
      # privileged:true) to tail node logs — default baseline PSS blocks it.
      labels:
        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
