homelab/k8s/argocd/apps/00-substrate.yaml

# Wave 0/1 — cluster substrate: cert-manager, ingress-nginx, reloader, and the
# Let's Encrypt issuers + wildcard cert. Previously installed by Terraform; now
# owned by app-of-apps (Pure GitOps). Controllers at wave 0; the ClusterIssuers
# and wildcard Certificate at wave 1 so cert-manager CRDs exist first.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: cert-manager
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  project: homelab
  revisionHistoryLimit: 3
  sources:
    - repoURL: https://charts.jetstack.io
      chart: cert-manager
      targetRevision: "v1.21.0"
      helm:
        valueFiles:
          - $values/k8s/bootstrap/cert-manager/cert-manager-values.yaml
    - repoURL: [email protected]:Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: cert-manager
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
# ingress-nginx removed: duplicate of ingress-nginx-bootstrap
# The bootstrap version (k8s/bootstrap-local/06-ingress-nginx.yaml) is kept
# to break the circular dependency (ArgoCD needs Forgejo domain access)
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: reloader
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  project: homelab
  revisionHistoryLimit: 3
  source:
    repoURL: https://stakater.github.io/stakater-charts
    chart: reloader
    targetRevision: "2.2.14"
    helm:
      values: |
        reloader:
          deployment:
            tolerations:
              - key: node-role.kubernetes.io/control-plane
                operator: Exists
                effect: NoSchedule
  destination:
    server: https://kubernetes.default.svc
    namespace: reloader
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
# Wave 1 — LE ClusterIssuers + wildcard cert (needs cert-manager CRDs from wave 0).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: cert-manager-issuers
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: homelab
  revisionHistoryLimit: 3
  source:
    repoURL: [email protected]:Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/bootstrap/cert-manager
    directory:
      include: "{letsencrypt-issuer.yaml,homelab-ca-issuer.yaml,homelab-ca-configmap.yaml}"
  destination:
    server: https://kubernetes.default.svc
    namespace: cert-manager
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Consolidated: wildcard-cert + homelab-ingress → ingress-config
# Manages both the wildcard TLS certificate and all Ingress rules.
# Certificate must exist before Ingresses (wave 1), but both are in same directory.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: ingress-config
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: homelab
  revisionHistoryLimit: 3
  source:
    repoURL: [email protected]:Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/bootstrap/ingress
  destination:
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true