homelab/k8s/argocd/apps/30-security.yaml

# Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
# runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
# in k8s/security/iam) resolved by the ArgoCD SOPS plugin at sync time.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://helm.releases.hashicorp.com
      chart: vault
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/security/iam/vault-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://charts.goauthentik.io
      chart: authentik
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/security/iam/authentik-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Raw IAM manifests: key-rotation cronjob + authentik migration job.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: iam-jobs
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
    path: k8s/security/iam
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Forgejo runner (local chart). Forgejo itself is Phase 0 (bootstrap).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
    path: k8s/security/ci-cd/charts/forgejo-runner
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true