Story Crater Bot
84aefc8db2
Adds Homarr landing page with Authentik SSO: - k8s/argocd/apps/60-applications.yaml: multi-source Application (homarr chart from homarr-labs + in-repo values), ns dashboard, wave 8 - k8s/bootstrap/ingress/ingress.yaml: homarr.riotpiao.com → dashboard/homarr:3000 - k8s/bootstrap/coredns/coredns-configmap.yaml: rewrite homarr.riotpiao.com to ingress controller - k8s/security/iam/scripts/authentik-provision.py: added 'homarr' to SERVICES (generates OAuth provider/app + homarr-oidc secret with client-id/secret) - k8s/security/iam/rbac-dashboard-rolebinding.yaml: grants authentik-provisioner SA access to dashboard ns for secret management - k8s/security/iam/kustomization.yaml: includes new RoleBinding Homarr now fully wired: - Ingress: https://homarr.riotpiao.com - SSO: redirects to Authentik, login as rock - Persistence: 5Gi RWO on longhorn-wffc (3-replica HA) - Tile config: UI-managed (saved to PVC)
164 lines
4.2 KiB
YAML
164 lines
4.2 KiB
YAML
# Wave 8 — end-user workloads: Temporal, Portainer, and the two network
|
|
# helpers (cloudflared tunnel, duckdns updater) that are already running.
|
|
# Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
|
|
# NOT included yet — add them here once they're production-ready.
|
|
# Syncs the CNPG-generated temporal-db-role Secret from ddb -> temporal ns
|
|
# (see db-secret-sync/copy-job.yaml for why this is a separate Application
|
|
# rather than folded into temporal/'s own kustomization). Runs one wave
|
|
# before `temporal` so the Secret exists before the server pods start.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: temporal-db-secret-sync
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "7"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
path: k8s/applications/temporal/db-secret-sync
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: temporal
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: temporal
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://go.temporal.io/helm-charts
|
|
chart: temporal
|
|
targetRevision: "0.74.0"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/applications/temporal/temporal-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: temporal
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: portainer
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://portainer.github.io/k8s/
|
|
chart: portainer
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/applications/portainer/portainer-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: dashboard
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: cloudflared
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
path: k8s/applications/cloudflared
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cloudflared
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: duckdns
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
path: k8s/applications/duckdns
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: duckdns
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: homarr
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://homarr-labs.github.io/charts
|
|
chart: homarr
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/applications/homarr/homarr-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: dashboard
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|