rock
6312674058
The macOS workload is scaled to 0 and its PVC macos-disk has been Pending for 72 days against storage class longhorn-imessage-local. No node carries the workload=imessage label it pins to. The namespace only holds that dead PVC plus two unused Services. Remove the Application, the manifests and the namespace so ArgoCD prunes them.
261 lines
7.5 KiB
YAML
261 lines
7.5 KiB
YAML
# Wave 8 — end-user workloads: Temporal, Portainer, and the cloudflared tunnel.
|
|
# Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
|
|
# NOT included yet — add them here once they're production-ready.
|
|
# temporal using unified CNPG pattern (app user, temporal-db-app secret)
|
|
# Secret copied by bootstrap.sh (like cicd/iam namespaces)
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: temporal
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://go.temporal.io/helm-charts
|
|
chart: temporal
|
|
targetRevision: "0.74.0"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/apps/temporal/temporal-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/temporal
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: temporal
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: portainer
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://portainer.github.io/k8s/
|
|
chart: portainer
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/apps/portainer/portainer-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: dashboard
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: cloudflared
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/cloudflared
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cloudflared
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: agent-pod
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/agent-pod
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: agent-pod
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Document management. Raw manifests (no Helm): postgres is the dedicated
|
|
# paperless-db CNPG cluster in k8s/infra/databases (wave 2), redis is
|
|
# in-cluster only (no PVC), media lives on the cp-3 USB HDD (see
|
|
# k8s/infra/longhorn/longhorn-paperless-storageclass.yaml). OIDC via
|
|
# Authentik provisioned by k8s/infra/iam's PostSync job; MinIO backup bucket
|
|
# creds provisioned by k8s/infra/minio's PostSync job.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: paperless
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/paperless
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: paperless
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Photo/video backup. Self-contained (unlike paperless, its CNPG Postgres
|
|
# lives here too, not in k8s/infra/databases) - CreateNamespace=true creates
|
|
# the namespace before any manifest in this Application applies, including
|
|
# the Cluster CR, so no separate wave-2 pre-creation step is needed. Postgres
|
|
# is pg18 (not this repo's usual 16.2) because CNPG's official pgvector
|
|
# extension image only publishes pg18 builds - see k8s/apps/immich/db.yaml.
|
|
# media PVC shares the cp-3 HDD 2TB/2TB with paperless-media. OIDC via
|
|
# Authentik provisioned by k8s/infra/iam's PostSync job (immich entry in
|
|
# SERVICES + immich_role scope mapping for admin-via-claim).
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: immich
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/immich
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: immich
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Consolidated: homarr + homarr-patches → homarr
|
|
# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: homarr
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://homarr-labs.github.io/charts
|
|
chart: homarr
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/apps/homarr/homarr-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/homarr # PostSync hook: fix-probes-job.yaml
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: dashboard
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
|
|
# Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
|
|
# which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: portfolio
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
# Image promotion: Forgejo package webhook → api-gw.
|
|
# Replaced ArgoCD Image Updater (removed 2026-09-10).
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/riotpiao.com.git
|
|
targetRevision: main
|
|
path: infra/portfolio/base
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: portfolio
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Wave 9 - per-service scoped RBAC (Role/RoleBinding), deliberately last so
|
|
# every target namespace above already exists. Inert until kube-apiserver
|
|
# gets --oidc-groups-claim=groups wired up (separate, not-yet-applied
|
|
# terraform/talosctl change) - these grant nothing until then.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: rbac
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "9"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/rbac
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
# No namespace: cluster-scoped resources (ClusterRoleBinding, etc.)
|
|
# Namespace is set per-resource in kustomization
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|