rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

Browse Source
This commit is contained in:
Story Crater Bot
2026-08-18 15:08:02 -07:00
parent 491e88e493
commit 54bfb5ade6
86 changed files with 889 additions and 446 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/argocd/apps/0-minio.yaml
+3 -3
View File
@@ -10,7 +10,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
@@ -35,7 +35,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
@@ -60,7 +60,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/monitoring
directory:
k8s/argocd/apps/00-homelab-root.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/argocd/root
destination:
k8s/argocd/apps/1-wave-1.yaml
+29 -28
View File
@@ -10,7 +10,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-iam
directory:
@@ -33,7 +33,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/logging
directory:
@@ -45,29 +45,30 @@ spec:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cloudnative-pg
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/ddb
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: ddb
syncPolicy:
automated:
prune: true
selfHeal: true
# cloudnative-pg: managed separately via k8s/argocd/apps/cnpg-operator.yaml
# (Helm-source Application, avoids the git chicken-egg for the operator itself)
# apiVersion: argoproj.io/v1alpha1
# kind: Application
# metadata:
# name: cloudnative-pg
# namespace: argocd
# annotations:
# argocd.argoproj.io/sync-wave: "1"
# spec:
# project: homelab
# source:
# repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
# targetRevision: main
# path: k8s/ddb
# directory:
# recurse: false
# destination:
# server: https://kubernetes.default.svc
# namespace: ddb
# syncPolicy:
# automated:
# prune: true
# selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
@@ -79,7 +80,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-iam
directory:
@@ -101,7 +102,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/temporal
directory:
@@ -124,7 +125,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
k8s/argocd/apps/2-wave-2.yaml
+28 -27
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
@@ -31,7 +31,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
@@ -54,7 +54,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/logging
directory:
@@ -77,7 +77,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/logging
directory:
@@ -89,26 +89,27 @@ spec:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: forgejo
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-ci-cd
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: cicd
syncPolicy:
automated:
prune: true
selfHeal: true
# forgejo: managed separately via k8s/argocd/apps/forgejo.yaml
# (Helm-source Application with inlined values, avoids the git chicken-egg)
# apiVersion: argoproj.io/v1alpha1
# kind: Application
# metadata:
# name: forgejo
# namespace: argocd
# annotations:
# argocd.argoproj.io/sync-wave: "2"
# spec:
# project: homelab
# source:
# repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
# targetRevision: main
# path: k8s/talos-ci-cd
# directory:
# recurse: false
# destination:
# server: https://kubernetes.default.svc
# namespace: cicd
# syncPolicy:
# automated:
# prune: true
# selfHeal: true
k8s/argocd/apps/3-wave-3.yaml
+2 -2
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-ci-cd
directory:
@@ -31,7 +31,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/portainer
directory:
k8s/argocd/apps/cnpg-operator.yaml
+22
View File
@@ -0,0 +1,22 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cnpg-operator
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://cloudnative-pg.github.io/charts
chart: cloudnative-pg
targetRevision: "*"
destination:
server: https://kubernetes.default.svc
namespace: ddb
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/forgejo.yaml
+146
View File
@@ -0,0 +1,146 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: forgejo
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "7"
# Must sync after cnpg-operator (wave 0) and the ddb-cluster/forgejo-database
# (wave 6, k8s/data) — Forgejo's DB connection depends on both existing first.
spec:
project: homelab
source:
repoURL: https://dl.gitea.com/charts/
chart: gitea
targetRevision: "~10"
helm:
# Mirrors k8s/security/ci-cd/forgejo-values.yaml inline — avoids the
# git-repo chicken-egg (Forgejo can't source its own values from a repo
# it hosts). Keep both files in sync when editing either one.
valuesObject:
image:
repository: codeberg.org/forgejo/forgejo
tag: "13"
pullPolicy: IfNotPresent
gitea:
admin:
username: rock
email: [email protected]
config:
server:
PROTOCOL: http
DOMAIN: forgejo.riotpiao.com
ROOT_URL: https://forgejo.riotpiao.com/
HTTP_PORT: 3000
START_SSH_SERVER: true
SSH_DOMAIN: forgejo.riotpiao.com
SSH_PORT: 2222
SSH_LISTEN_PORT: 2222
database:
DB_TYPE: postgres
HOST: ddb-cluster-rw.ddb.svc:5432
NAME: forgejo
USER: app
repository:
ROOT: /data/git
actions:
ENABLED: true
packages:
ENABLED: true
metrics:
ENABLED: true
service:
DISABLE_REGISTRATION: true
oauth2:
ENABLED: true
PROVIDER: openidconnect
OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
CLIENT_ID: forgejo
AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
cache:
ADAPTER: redis
HOST: "redis://forgejo-redis.cicd.svc:6379/0"
session:
PROVIDER: redis
PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
queue:
TYPE: redis
CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
metrics:
enabled: true
serviceMonitor:
enabled: false
persistence:
enabled: true
storageClass: longhorn
size: 20Gi
accessModes:
- ReadWriteMany
replicaCount: 2
deployment:
strategy:
type: RollingUpdate
env:
- name: SSL_CERT_DIR
value: /homelab-ca
- name: GITEA__database__PASSWD
valueFrom:
secretKeyRef:
name: ddb-cluster-app
key: password
podAnnotations:
configmap.reloader.stakater.com/reload: "homelab-ca"
service:
http:
type: LoadBalancer
port: 3000
targetPort: 3000
annotations:
io.cilium/lb-ipam-ips: "192.168.1.165"
io.cilium/lb-ipam-sharing-key: "forgejo"
ssh:
type: LoadBalancer
port: 2222
targetPort: 2222
annotations:
io.cilium/lb-ipam-ips: "192.168.1.165"
io.cilium/lb-ipam-sharing-key: "forgejo"
resources:
requests:
cpu: 250m
memory: 512Mi
limits:
cpu: "1"
memory: 1Gi
tolerations:
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
extraVolumes:
- name: homelab-ca
configMap:
name: homelab-ca
extraVolumeMounts:
- name: homelab-ca
mountPath: /homelab-ca
readOnly: true
ingress:
enabled: false
postgresql:
enabled: false
postgresql-ha:
enabled: false
mysql:
enabled: false
redis-cluster:
enabled: false
act_runner:
enabled: false
destination:
server: https://kubernetes.default.svc
namespace: cicd
syncPolicy:
syncOptions:
- CreateNamespace=true
# NO automated sync — Forgejo is what CI uses to push commits; auto-sync
# would let a bad CI commit break the system CI depends on. Manual only.
k8s/argocd/apps/layer-1-infrastructure.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/infrastructure
destination:
k8s/argocd/apps/layer-2-bootstrap.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/bootstrap
destination:
k8s/argocd/apps/layer-3-platform.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/platform
destination:
k8s/argocd/apps/layer-4-security.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/security
destination:
k8s/argocd/apps/layer-5-applications.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/applications
destination:
k8s/argocd/apps/layer-6-data.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/data
destination:
k8s/argocd/apps/phase0-minio.yaml
+2 -2
View File
@@ -67,12 +67,12 @@ spec:
purge: false
environment:
MINIO_IDENTITY_OPENID_CONFIG_URL: https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration
MINIO_IDENTITY_OPENID_CONFIG_URL: https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration
MINIO_IDENTITY_OPENID_CLIENT_ID: minio
MINIO_IDENTITY_OPENID_CLIENT_SECRET: 9d2867fe08c3bf7fedd7e32bbaf4456fce3b0aaf788966d7559e1955947b0219
MINIO_IDENTITY_OPENID_CLAIM_NAME: policy
MINIO_IDENTITY_OPENID_SCOPES: openid,profile,email,minio
MINIO_IDENTITY_OPENID_REDIRECT_URI: https://minio.riotpiao.homelab.com/oauth_callback
MINIO_IDENTITY_OPENID_REDIRECT_URI: https://minio.riotpiao.com/oauth_callback
MINIO_IDENTITY_OPENID_DISPLAY_NAME: Authentik
destination:
k8s/argocd/apps/phase1-hookless-0.yaml
+5 -5
View File
@@ -82,7 +82,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs/charts/kafka-cluster
helm:
@@ -117,7 +117,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs/charts/queue-crd
helm:
@@ -146,7 +146,7 @@ metadata:
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs/charts/management-service
helm:
@@ -155,11 +155,11 @@ spec:
env:
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
authentikIssuerURL: "https://authentik.riotpiao.homelab.com/application/o/kafaka/"
authentikIssuerURL: "https://authentik.riotpiao.com/application/o/kafaka/"
authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"
ingress:
enabled: true
host: kmsvc.riotpiao.homelab.com
host: kmsvc.riotpiao.com
clusterIssuer: homelab-ca
destination:
server: https://kubernetes.default.svc
k8s/argocd/apps/phase2-storage-observability-0.yaml
+2 -2
View File
@@ -17,7 +17,7 @@ spec:
helm:
valueFiles:
- k8s/monitoring/prometheus-values.yaml
- repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase2
destination:
@@ -47,7 +47,7 @@ spec:
helm:
valueFiles:
- k8s/ddb/cnpg-values.yaml
- repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase2
destination:
k8s/argocd/apps/phase2-storage-observability-1.yaml
+2 -2
View File
@@ -95,13 +95,13 @@ metadata:
spec:
project: homelab
sources:
- repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-ci-cd/charts/forgejo-runner
helm:
valueFiles:
- values.yaml
- repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase2
destination:
k8s/argocd/apps/phase3-iam-0.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
valueFiles:
- k8s/talos-iam/authentik-values.yaml
- k8s/talos-iam/authentik-secrets.enc.yaml
- repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase3
destination: