refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-07-16 14:28:19 -07:00
parent a81b9b6169
commit 2d7330798b
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,81 @@
+# .forgejo/workflows/ci.yml
+#
+# Copy to YOUR APPLICATION REPO at .forgejo/workflows/ci.yml
+# (not this infra repo — this is a template).
+#
+# What this does (on every push to main):
+#   1. Run tests — fail here and nothing ships.
+#   2. Build a Docker image and push it to the Forgejo built-in OCI registry.
+#   3. Clone rock/deploy, bump the image tag in api/deployment.yaml, push the commit.
+#   4. Argo CD sees the commit within 3 minutes and rolls out the new version.
+#
+# Required repo secrets (Forgejo UI → repo → Settings → Actions → Secrets):
+#   REGISTRY_TOKEN  — ci-bot's package:write Forgejo API token
+#   DEPLOY_TOKEN    — ci-bot's repo:write Forgejo API token (scoped to rock/deploy only)
+#
+# Prerequisites:
+#   - ci-bot user created in Forgejo (see IAM section §11.5 of talos_version_control.html)
+#   - ci-bot added as collaborator on rock/deploy with Write access
+#   - Runner (cicd ns) is online and registered (Block 3 of build runbook)
+#   - Talos nodes trust the homelab CA (Block 2 of build runbook)
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build-push-deploy:
+    runs-on: docker
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # ── 1. Tests ────────────────────────────────────────────────────────────
+      - name: test
+        run: make test   # replace with your test command; failure stops the pipeline
+
+      # ── 2. Build + push OCI image ───────────────────────────────────────────
+      - name: build and push image
+        env:
+          REGISTRY: forgejo.forge.riotpiao.homelab.com
+          OWNER: rock
+        run: |
+          REPO_NAME=${{ github.event.repository.name }}
+          TAG=$(git rev-parse --short HEAD)
+          IMAGE="${REGISTRY}/${OWNER}/${REPO_NAME}:${TAG}"
+
+          echo "${{ secrets.REGISTRY_TOKEN }}" \
+            | docker login "${REGISTRY}" -u "${OWNER}" --password-stdin
+
+          docker build -t "${IMAGE}" .
+          docker push "${IMAGE}"
+
+          # Pass values to subsequent steps
+          echo "TAG=${TAG}"          >> "$GITHUB_ENV"
+          echo "IMAGE=${IMAGE}"      >> "$GITHUB_ENV"
+          echo "REPO_NAME=${REPO_NAME}" >> "$GITHUB_ENV"
+
+      # ── 3. Bump image tag in the deploy repo ────────────────────────────────
+      # This is the ONLY write operation CI has on the cluster side.
+      # Argo CD notices the commit and rolls out the new image.
+      - name: bump deploy repo
+        env:
+          REGISTRY: forgejo.forge.riotpiao.homelab.com
+          OWNER: rock
+        run: |
+          git clone \
+            "https://ci-bot:${{ secrets.DEPLOY_TOKEN }}@${REGISTRY}/${OWNER}/deploy.git" \
+            /tmp/deploy
+
+          TARGET_FILE="/tmp/deploy/${REPO_NAME}/deployment.yaml"
+
+          sed -i \
+            "s|${REGISTRY}/${OWNER}/${REPO_NAME}:.*|${IMAGE}|" \
+            "${TARGET_FILE}"
+
+          git -C /tmp/deploy \
+            -c user.name="ci-bot" \
+            -c user.email="[email protected]" \
+            commit -am "${REPO_NAME}: deploy ${TAG}"
+
+          git -C /tmp/deploy push