homelab/k8s/argocd/apps/30-security.yaml

# Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
# runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
# in k8s/infra/iam) resolved by the ArgoCD SOPS plugin at sync time.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://helm.releases.hashicorp.com
      chart: vault
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/infra/iam/vault-values.yaml
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://charts.goauthentik.io
      chart: authentik
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/infra/iam/authentik-values.yaml
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Raw IAM manifests: key-rotation cronjob + authentik migration job.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: iam-jobs
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/infra/iam
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
# under Argo, because values changes there were inert — a proxy-body-size fix
# sat committed while the live Ingress kept nginx's 1m default and rejected
# every OCI push with 413.
#
# Wave 3: after databases (wave 2) — Forgejo needs CNPG and Redis up first.
#
# Retiring the Helm release: Argo adopts the existing objects on first sync.
# Delete the release secrets afterwards so helm stops claiming ownership:
#   kubectl -n cicd delete secret -l owner=helm,name=forgejo
#
# automated sync is deliberately absent. This chart owns the Forgejo PVC and
# the git forge itself; the first sync is manual so its diff can be read before
# anything is applied. Turn on automated+selfHeal once that diff is clean.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://dl.gitea.com/charts/
      chart: gitea
      targetRevision: 12.7.0
      helm:
        valueFiles:
          - $values/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  # Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
  # so the pod rolls when that Secret changes. The chart does not render it, so
  # Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
  # would fight over the field and Recreate the forge each round.
  ignoreDifferences:
    - group: apps
      kind: Deployment
      name: forgejo-gitea
      jqPathExpressions:
        - '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
  syncPolicy:
    syncOptions:
      # Adopt the objects the bootstrap Helm release already created rather
      # than failing on "already exists".
      - ServerSideApply=true
---
# Forgejo runner (local chart), single generic "docker"-labeled instance.
# Being retired in favor of three language-specific instances of the same
# chart (forgejo-runner-golang/-node/-rust). Added here ahead of that removal,
# in its own commit, so it syncs BEFORE the Application is deleted -- a
# non-cascading delete would otherwise orphan this Deployment, its dind
# sidecar and both PVCs (same lesson as the Kong retirement).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: homelab
  source:
    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/infra/forgejo-runner
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true