# Wave 1 — MinIO (operator + tenant), Longhorn policy, Prometheus stack.
# Helm charts pull from public repos; values come from the git repo via a
# second "ref: values" source (ArgoCD multi-source pattern).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: minio-operator
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: homelab
  sources:
    - repoURL: https://operator.min.io/
      chart: operator
      targetRevision: "5.0.18"
      helm:
        valueFiles:
          - $values/k8s/infrastructure/minio/minio-operator-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: storage
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
# Tenant + buckets + replication are raw CRs (MinIO Tenant CRD from operator).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: minio-tenant
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
    path: k8s/infrastructure/minio
  destination:
    server: https://kubernetes.default.svc
    namespace: storage
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
# Longhorn itself is substrate (bootstrap-installed); this app manages only its
# ServiceMonitor / policy manifests.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: longhorn-config
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
    path: k8s/infrastructure/longhorn
  destination:
    server: https://kubernetes.default.svc
    namespace: longhorn-system
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: prometheus
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: homelab
  sources:
    - repoURL: https://prometheus-community.github.io/helm-charts
      chart: kube-prometheus-stack
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/platform/monitoring/prometheus-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: monitoring
  syncPolicy:
    managedNamespaceMetadata:
      # node-exporter needs hostNetwork/hostPID/hostPath/hostPort; blocked by
      # default baseline PSS (DaemonSet created 0 pods, Prometheus STS stuck).
      labels:
        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      # ServerSideApply removed — it conflicts with managedNamespaceMetadata's
      # forced namespace apply ("--force cannot be used with --server-side").
      # The large monitoring CRDs are installed out-of-band instead.
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: blackbox-exporter
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: homelab
  sources:
    - repoURL: https://prometheus-community.github.io/helm-charts
      chart: prometheus-blackbox-exporter
      targetRevision: "~11"
      helm:
        valueFiles:
          - $values/k8s/platform/monitoring/blackbox-exporter-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: monitoring
  syncPolicy:
    automated:
      prune: true
      selfHeal: true