homelab/k8s/argocd/apps/30-security.yaml

# Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
# runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
# in k8s/infra/iam) resolved by the ArgoCD SOPS plugin at sync time.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://helm.releases.hashicorp.com
      chart: vault
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/infra/iam/vault-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://charts.goauthentik.io
      chart: authentik
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/infra/iam/authentik-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# ZITADEL — the Authentik replacement. Coexistence, not cutover: Authentik keeps
# serving in the same `iam` namespace until the last consumer moves, then this
# becomes the only IdP. Migration plan (outside git):
# ~/workplace/homelab-doc/ZITADEL_MIGRATION.html
#
# Wave 3 ordering: sops-secrets (wave 0) creates the `zitadel-masterkey` Secret,
# databases (wave 2) creates the `zitadel-db` CNPG cluster and its
# `zitadel-db-app` DSN secret. Both must exist before the init job starts.
#
# automated sync is deliberately absent for the first sync — same reason as
# forgejo. The chart ships `pre-install,pre-upgrade` Helm hooks (zitadel-init,
# zitadel-setup), which ArgoCD maps to PreSync and re-runs on every sync, manual
# or automated. A human reads the first sync's hook output before any repeat can
# run. The init job runs `init zitadel` only (CNPG owns the database and the app
# user), and the setup job creates the first org and the `iam-admin` machine key
# that Terraform consumes. Read the SECOND-SYNC HAZARD block at the top of
# k8s/infra/iam/zitadel-values.yaml before enabling automated sync.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: zitadel
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  revisionHistoryLimit: 3
  sources:
    - repoURL: https://charts.zitadel.com
      chart: zitadel
      # Pinned: the chart trails the upstream app release, and the verified
      # masterkey/passwap facts were read at v4.19.x. A floating tag would
      # change the app version without a diff anyone reviews.
      targetRevision: 10.4.0
      helm:
        valueFiles:
          - $values/k8s/infra/iam/zitadel-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    syncOptions:
      - CreateNamespace=true
---
# Raw IAM manifests: key-rotation cronjob + authentik migration job.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: iam-jobs
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
    targetRevision: main
    path: k8s/infra/iam
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
# under Argo, because values changes there were inert — a proxy-body-size fix
# sat committed while the live Ingress kept nginx's 1m default and rejected
# every OCI push with 413.
#
# Wave 3: after databases (wave 2) — Forgejo needs CNPG and Redis up first.
#
# Retiring the Helm release: Argo adopts the existing objects on first sync.
# Delete the release secrets afterwards so helm stops claiming ownership:
#   kubectl -n cicd delete secret -l owner=helm,name=forgejo
#
# automated sync is deliberately absent. This chart owns the Forgejo PVC and
# the git forge itself; the first sync is manual so its diff can be read before
# anything is applied. Turn on automated+selfHeal once that diff is clean.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://dl.gitea.com/charts/
      chart: gitea
      targetRevision: 12.7.0
      helm:
        valueFiles:
          - $values/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  # Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
  # so the pod rolls when that Secret changes. The chart does not render it, so
  # Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
  # would fight over the field and Recreate the forge each round.
  ignoreDifferences:
    - group: apps
      kind: Deployment
      name: forgejo-gitea
      jqPathExpressions:
        - '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
  syncPolicy:
    syncOptions:
      # Adopt the objects the bootstrap Helm release already created rather
      # than failing on "already exists".
      - ServerSideApply=true
---
# Forgejo runners (local chart, one instance per language), replacing the
# single generic "docker"-labeled runner. Each instance is a full standalone
# Deployment with its own dind sidecar, own PVCs (registration + layer
# cache) and own registered label -- there is no shared generic runner
# anymore, so each instance also builds and pushes images for the repos it
# serves (the chart's ConfigMap/NetworkPolicy fixes for that -- valid_volumes,
# network: host, egress to ingress-nginx -- apply identically to all three).
#
# `values.yaml` is the chart's default and doubles as the golang instance's
# config; node and rust layer a small values-<lang>.yaml override on top for
# just runner.name/runner.labels. All three share one runner-token Secret
# (Forgejo registration tokens are reusable across multiple runners, unlike
# GitHub's one-time tokens) -- if that assumption is ever wrong, registration
# will fail loudly in the register initContainer's logs, not silently.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner-golang
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
    # Image promotion: Forgejo package webhook → api-gw.
    # Replaced ArgoCD Image Updater (removed 2026-09-10).
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
    targetRevision: main
    path: k8s/infra/forgejo-runner
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner-node
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
    # Image promotion: Forgejo package webhook → api-gw.
    # Replaced ArgoCD Image Updater (removed 2026-09-10).
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
    targetRevision: main
    path: k8s/infra/forgejo-runner
    helm:
      valueFiles:
        - values-node.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner-rust
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
    # Image promotion: Forgejo package webhook → api-gw.
    # Replaced ArgoCD Image Updater (removed 2026-09-10).
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
    targetRevision: main
    path: k8s/infra/forgejo-runner
    helm:
      valueFiles:
        - values-rust.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true