Story Crater Bot
72ab6b6973
fix: terraform fmt — normalize formatting across all files
2026-07-15 21:01:55 -07:00
Story Crater Bot
e4d645eae9
feat: Terraform CI via Forgejo Actions + MinIO S3 state backend
...
- ArgoCD manages MinIO (phase 0), Terraform manages infrastructure
- Runner workflow: pulls state from S3, validates, plans, applies
- 34 resources imported to state, S3 backend operational
- Fixed AppProject repos, S3 endpoint deprecation, runner package manager
2026-07-15 18:48:32 -07:00
Story Crater Bot
d2f4b3c7e4
Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"
...
This reverts commit e7f3409d0f
2026-07-15 14:59:54 -07:00
Story Crater Bot and Claude Haiku 4.5
e7f3409d0f
feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership
...
Phase 0 groundwork for helmfile→ArgoCD migration:
1. Remove 3 bootstrap releases from helmfile (cert-manager, reloader, ingress-nginx)
— already managed by terraform/bootstrap-releases.tf; eliminates dual-ownership
2. Bootstrap ESO (External Secrets Operator) as TF-managed release
— required for all ExternalSecret resources in phases 1-3
— added to bootstrap-releases.tf + helm-repositories.tf
3. Create ClusterSecretStore connecting ESO to Vault (K8s auth)
— enables per-namespace/per-release secret injection
— vault config documented in docs/PHASE0-ESO-VAULT-SETUP.md (manual setup)
4. Fix argocd-bootstrap.tf CA cert copy: use jq instead of sed for cleaner metadata handling
Changes:
- helmfile.yaml.gotmpl: remove cert-manager/reloader/ingress-nginx blocks
- terraform/bootstrap-releases.tf: add external-secrets release
- terraform/helm-repositories.tf: add external-secrets Helm repo
- k8s/external-secrets/clustersecretstore.yaml: ESO→Vault ClusterSecretStore
- k8s/argocd/apps/0-wave-0.yaml: stub wave 0 applications (schema fix, rewrite pending Phase 1)
- docs/PHASE0-ESO-VAULT-SETUP.md: manual ESO-Vault auth setup procedure
Next: Phase 1 will incrementally rewrite ArgoCD Applications + migrate helmfile releases.
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-07-15 14:53:16 -07:00
Story Crater Bot
6d554961c2
feat(terraform): enable S3 remote state backend (MinIO)
...
Migrate terraform state from local file to MinIO S3 bucket (terraform-state).
Backend config: https://minio-api.riotpiao.homelab.com (external endpoint).
State now persisted remotely, shared across team, safe for cluster rebuild.
Also added terraform-state bucket to MinIO managed buckets.
2026-07-14 23:30:45 -07:00
Story Crater Bot
52cb895cda
feat(minio): add loki storage buckets (chunks/ruler/admin/index)
...
Move loki bucket creation from helmfile post-hook to TF-managed buckets array.
Now all MinIO buckets (6 total) declared in terraform/minio.tf for IaC completeness.
2026-07-14 17:00:09 -07:00
Story Crater Bot
9e3781a069
fix(minio): migrate to official chart, TF-owned
...
Bitnami wiped Docker Hub catalog (bitnami/minio: 0 tags), chart 14.1.0
dead on ImagePullBackOff. Move to minio/minio 5.4.0 (quay.io) as one TF
helm_release. Add longhorn-xfs SC: default SC ext4 mkfs on 100Gi exceeds
kubelet mount timeout, xfs near-instant. Drop minio ArgoCD Apps (TF owns
now, kills dual-controller conflict). Fix double base64 on OIDC secret.
2026-07-14 16:07:03 -07:00
Story Crater Bot