# ArgoCD Root App-of-Apps — GitHub seed source (circle-breaker).
# Applied ONCE at Phase 0 (manual), BEFORE Forgejo serves the repo. Points at the
# GitHub seed so ArgoCD can deploy everything after the control plane. After
# Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml.
#
# repoURL is anonymous HTTPS — the seed repo is public, so no deploy key and no
# repository Secret are needed. Nothing to apply before this.
---
apiVersion: v1
kind: Namespace
metadata:
  name: argocd
---
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: homelab
  namespace: argocd
spec:
  description: Homelab infrastructure and applications
  # Single-tenant homelab: all sources are trusted (GitHub seed, Forgejo, and the
  # public Helm chart repos the app tree pulls from). Wildcard avoids silently
  # blocking a chart host (operator.min.io, hashicorp, strimzi.io, go.temporal.io,
  # dl.gitea.io, *.github.io, charts.*, …).
  sourceRepos:
    - '*'
  destinations:
    - namespace: '*'
      server: 'https://kubernetes.default.svc'
  clusterResourceWhitelist:
    - group: '*'
      kind: '*'
  namespaceResourceWhitelist:
    - group: '*'
      kind: '*'
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: homelab-root
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: homelab
  source:
    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git   # GitHub seed (SSH)
    targetRevision: main
    path: k8s/argocd/apps
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m