# Phase 0 — MinIO (S3 backend for Terraform state)
# Deployed first, before all other applications
# Note: MinIO PVC managed separately (prevent_destroy in terraform/minio.tf)

---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: minio
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  project: homelab
  sources:
    - repoURL: https://charts.min.io/
      chart: minio
      targetRevision: 5.4.0
      helm:
        values: |
          mode: standalone
          replicas: 1
          drivesPerNode: 1
          pools: 1

          rootUser: minioadmin
          rootPassword: nhKRAxwIjDBCzwFDvsAa7dNLouCXXh13LvMoxMVkUtY=

          persistence:
            enabled: true
            size: 100Gi
            storageClass: longhorn-xfs
            accessMode: ReadWriteOnce

          resources:
            requests:
              memory: 512Mi

          service:
            type: ClusterIP
            port: 9000
          consoleService:
            type: ClusterIP
            port: 9001

          buckets:
            - name: terraform-state
              policy: none
              purge: false
            - name: vault
              policy: none
              purge: false
            - name: riotpiao-models
              policy: none
              purge: false
            - name: loki-chunks
              policy: none
              purge: false
            - name: loki-ruler
              policy: none
              purge: false
            - name: loki-admin
              policy: none
              purge: false
            - name: loki-index
              policy: none
              purge: false

          environment:
            MINIO_IDENTITY_OPENID_CONFIG_URL: https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration
            MINIO_IDENTITY_OPENID_CLIENT_ID: minio
            MINIO_IDENTITY_OPENID_CLIENT_SECRET: 9d2867fe08c3bf7fedd7e32bbaf4456fce3b0aaf788966d7559e1955947b0219
            MINIO_IDENTITY_OPENID_CLAIM_NAME: policy
            MINIO_IDENTITY_OPENID_SCOPES: openid,profile,email,minio
            MINIO_IDENTITY_OPENID_REDIRECT_URI: https://minio.riotpiao.homelab.com/oauth_callback
            MINIO_IDENTITY_OPENID_DISPLAY_NAME: Authentik

  destination:
    server: https://kubernetes.default.svc
    namespace: storage
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true