# ingress-nginx - required for Forgejo domain access before ArgoCD can sync
# This breaks the circular dependency: ArgoCD needs https://forgejo.riotpiao.com
# but that domain requires ingress-nginx to route traffic.
apiVersion: v1
kind: Namespace
metadata:
  name: ingress-nginx
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: ingress-nginx-bootstrap
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "0"
    description: "Bootstrap ingress-nginx to enable Forgejo domain access"
spec:
  project: homelab
  source:
    repoURL: https://kubernetes.github.io/ingress-nginx
    chart: ingress-nginx
    targetRevision: "4.15.1"
    helm:
      values: |
        controller:
          kind: DaemonSet
          service:
            type: LoadBalancer
            annotations:
              io.cilium/lb-ipam-ips: "192.168.1.160"
          hostPort:
            enabled: false
          tolerations:
            - key: node-role.kubernetes.io/control-plane
              operator: Exists
              effect: NoSchedule
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
  destination:
    server: https://kubernetes.default.svc
    namespace: ingress-nginx
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true