feat: Terraform CI via Forgejo Actions + MinIO S3 state backend

- ArgoCD manages MinIO (phase 0), Terraform manages infrastructure - Runner workflow: pulls state from S3, validates, plans, applies - 34 resources imported to state, S3 backend operational - Fixed AppProject repos, S3 endpoint deprecation, runner package manager
2026-07-15 18:48:32 -07:00
parent ab76e40d05
commit e4d645eae9
6 changed files with 355 additions and 68 deletions
@@ -0,0 +1,86 @@
+# Phase 0 — MinIO (S3 backend for Terraform state)
+# Deployed first, before all other applications
+# Note: MinIO PVC managed separately (prevent_destroy in terraform/minio.tf)
+
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: minio
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  sources:
+    - repoURL: https://charts.min.io/
+      chart: minio
+      targetRevision: 5.4.0
+      helm:
+        values: |
+          mode: standalone
+          replicas: 1
+          drivesPerNode: 1
+          pools: 1
+
+          rootUser: minioadmin
+          rootPassword: nhKRAxwIjDBCzwFDvsAa7dNLouCXXh13LvMoxMVkUtY=
+
+          persistence:
+            enabled: true
+            size: 100Gi
+            storageClass: longhorn-xfs
+            accessMode: ReadWriteOnce
+
+          resources:
+            requests:
+              memory: 512Mi
+
+          service:
+            type: ClusterIP
+            port: 9000
+          consoleService:
+            type: ClusterIP
+            port: 9001
+
+          buckets:
+            - name: terraform-state
+              policy: none
+              purge: false
+            - name: vault
+              policy: none
+              purge: false
+            - name: riotpiao-models
+              policy: none
+              purge: false
+            - name: loki-chunks
+              policy: none
+              purge: false
+            - name: loki-ruler
+              policy: none
+              purge: false
+            - name: loki-admin
+              policy: none
+              purge: false
+            - name: loki-index
+              policy: none
+              purge: false
+
+          environment:
+            MINIO_IDENTITY_OPENID_CONFIG_URL: https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration
+            MINIO_IDENTITY_OPENID_CLIENT_ID: minio
+            MINIO_IDENTITY_OPENID_CLIENT_SECRET: 9d2867fe08c3bf7fedd7e32bbaf4456fce3b0aaf788966d7559e1955947b0219
+            MINIO_IDENTITY_OPENID_CLAIM_NAME: policy
+            MINIO_IDENTITY_OPENID_SCOPES: openid,profile,email,minio
+            MINIO_IDENTITY_OPENID_REDIRECT_URI: https://minio.riotpiao.homelab.com/oauth_callback
+            MINIO_IDENTITY_OPENID_DISPLAY_NAME: Authentik
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: storage
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true