# Wave 8 — end-user workloads: Temporal, Portainer, and the cloudflared tunnel.
# Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
# NOT included yet — add them here once they're production-ready.
# temporal using unified CNPG pattern (app user, temporal-db-app secret)
# Secret copied by bootstrap.sh (like cicd/iam namespaces)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: temporal
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  sources:
    - repoURL: https://go.temporal.io/helm-charts
      chart: temporal
      targetRevision: "0.74.0"
      helm:
        valueFiles:
          - $values/k8s/apps/temporal/temporal-values.yaml
    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
      targetRevision: main
      ref: values
    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
      targetRevision: main
      path: k8s/apps/temporal
  destination:
    server: https://kubernetes.default.svc
    namespace: temporal
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: portainer
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  sources:
    - repoURL: https://portainer.github.io/k8s/
      chart: portainer
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/apps/portainer/portainer-values.yaml
    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: dashboard
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: cloudflared
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
    targetRevision: main
    path: k8s/apps/cloudflared
  destination:
    server: https://kubernetes.default.svc
    namespace: cloudflared
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: agent-pod
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
    targetRevision: main
    path: k8s/apps/agent-pod
  destination:
    server: https://kubernetes.default.svc
    namespace: agent-pod
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
# iMessage/SMS delivery. Raw manifests: a privileged macOS VM (Docker-OSX)
# running the BlueBubbles server, plus its dedicated local StorageClass.
#
# Pinned to worker-2 via nodeSelector `workload: imessage` + a matching
# toleration for that node's taint. Until worker-2 is provisioned this app
# syncs everything except the pod, which stays Pending — that is expected.
#
# No CreateNamespace: namespace.yaml carries `pod-security: privileged`, which
# the VM needs (/dev/kvm, privileged), and an ArgoCD-created namespace would
# not have those labels.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: sms
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
    targetRevision: main
    path: k8s/apps/sms
  destination:
    server: https://kubernetes.default.svc
    namespace: sms
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Document management. Raw manifests (no Helm): postgres is the dedicated
# paperless-db CNPG cluster in k8s/infra/databases (wave 2), redis is
# in-cluster only (no PVC), media lives on the cp-3 USB HDD (see
# k8s/infra/longhorn/longhorn-paperless-storageclass.yaml). OIDC via
# Authentik provisioned by k8s/infra/iam's PostSync job; MinIO backup bucket
# creds provisioned by k8s/infra/minio's PostSync job.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: paperless
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
    targetRevision: main
    path: k8s/apps/paperless
  destination:
    server: https://kubernetes.default.svc
    namespace: paperless
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
# Photo/video backup. Self-contained (unlike paperless, its CNPG Postgres
# lives here too, not in k8s/infra/databases) - CreateNamespace=true creates
# the namespace before any manifest in this Application applies, including
# the Cluster CR, so no separate wave-2 pre-creation step is needed. Postgres
# is pg18 (not this repo's usual 16.2) because CNPG's official pgvector
# extension image only publishes pg18 builds - see k8s/apps/immich/db.yaml.
# media PVC shares the cp-3 HDD 2TB/2TB with paperless-media. OIDC via
# Authentik provisioned by k8s/infra/iam's PostSync job (immich entry in
# SERVICES + immich_role scope mapping for admin-via-claim).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: immich
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
    targetRevision: main
    path: k8s/apps/immich
  destination:
    server: https://kubernetes.default.svc
    namespace: immich
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
# Consolidated: homarr + homarr-patches → homarr
# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: homarr
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  project: homelab
  sources:
    - repoURL: https://homarr-labs.github.io/charts
      chart: homarr
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/apps/homarr/homarr-values.yaml
    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
      targetRevision: main
      ref: values
    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
      targetRevision: main
      path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: dashboard
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
# Wave 9 - per-service scoped RBAC (Role/RoleBinding), deliberately last so
# every target namespace above already exists. Inert until kube-apiserver
# gets --oidc-groups-claim=groups wired up (separate, not-yet-applied
# terraform/talosctl change) - these grant nothing until then.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: rbac
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "9"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
    targetRevision: main
    path: k8s/infra/rbac
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true