rock
be55d68571
- Add Application for rock/riotpiao.com repo (portfolio site) - Replace wildcard sourceRepos with explicit repo list - Add CoreDNS rewrite for root domain riotpiao.com
289 lines
8.1 KiB
YAML
289 lines
8.1 KiB
YAML
# Wave 8 — end-user workloads: Temporal, Portainer, and the cloudflared tunnel.
|
|
# Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
|
|
# NOT included yet — add them here once they're production-ready.
|
|
# temporal using unified CNPG pattern (app user, temporal-db-app secret)
|
|
# Secret copied by bootstrap.sh (like cicd/iam namespaces)
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: temporal
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://go.temporal.io/helm-charts
|
|
chart: temporal
|
|
targetRevision: "0.74.0"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/apps/temporal/temporal-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/temporal
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: temporal
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: portainer
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://portainer.github.io/k8s/
|
|
chart: portainer
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/apps/portainer/portainer-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: dashboard
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: cloudflared
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/cloudflared
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cloudflared
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: agent-pod
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/agent-pod
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: agent-pod
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# iMessage/SMS delivery. Raw manifests: a privileged macOS VM (Docker-OSX)
|
|
# running the BlueBubbles server, plus its dedicated local StorageClass.
|
|
#
|
|
# Pinned to worker-2 via nodeSelector `workload: imessage` + a matching
|
|
# toleration for that node's taint. Until worker-2 is provisioned this app
|
|
# syncs everything except the pod, which stays Pending — that is expected.
|
|
#
|
|
# No CreateNamespace: namespace.yaml carries `pod-security: privileged`, which
|
|
# the VM needs (/dev/kvm, privileged), and an ArgoCD-created namespace would
|
|
# not have those labels.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: sms
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/sms
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: sms
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
# Document management. Raw manifests (no Helm): postgres is the dedicated
|
|
# paperless-db CNPG cluster in k8s/infra/databases (wave 2), redis is
|
|
# in-cluster only (no PVC), media lives on the cp-3 USB HDD (see
|
|
# k8s/infra/longhorn/longhorn-paperless-storageclass.yaml). OIDC via
|
|
# Authentik provisioned by k8s/infra/iam's PostSync job; MinIO backup bucket
|
|
# creds provisioned by k8s/infra/minio's PostSync job.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: paperless
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/paperless
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: paperless
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Photo/video backup. Self-contained (unlike paperless, its CNPG Postgres
|
|
# lives here too, not in k8s/infra/databases) - CreateNamespace=true creates
|
|
# the namespace before any manifest in this Application applies, including
|
|
# the Cluster CR, so no separate wave-2 pre-creation step is needed. Postgres
|
|
# is pg18 (not this repo's usual 16.2) because CNPG's official pgvector
|
|
# extension image only publishes pg18 builds - see k8s/apps/immich/db.yaml.
|
|
# media PVC shares the cp-3 HDD 2TB/2TB with paperless-media. OIDC via
|
|
# Authentik provisioned by k8s/infra/iam's PostSync job (immich entry in
|
|
# SERVICES + immich_role scope mapping for admin-via-claim).
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: immich
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/immich
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: immich
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Consolidated: homarr + homarr-patches → homarr
|
|
# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: homarr
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://homarr-labs.github.io/charts
|
|
chart: homarr
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/apps/homarr/homarr-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/homarr # PostSync hook: fix-probes-job.yaml
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: dashboard
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
|
|
# Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
|
|
# which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: portfolio
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/riotpiao.com.git
|
|
targetRevision: main
|
|
path: infra/portfolio/base
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: portfolio
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
# Wave 9 - per-service scoped RBAC (Role/RoleBinding), deliberately last so
|
|
# every target namespace above already exists. Inert until kube-apiserver
|
|
# gets --oidc-groups-claim=groups wired up (separate, not-yet-applied
|
|
# terraform/talosctl change) - these grant nothing until then.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: rbac
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "9"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/rbac
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: default
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|