homelab/k8s/argocd/apps/30-security.yaml

# Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
# runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
# in k8s/infra/iam) resolved by the ArgoCD SOPS plugin at sync time.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://helm.releases.hashicorp.com
      chart: vault
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/infra/iam/vault-values.yaml
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://charts.goauthentik.io
      chart: authentik
      targetRevision: "*"
      helm:
        valueFiles:
          - $values/k8s/infra/iam/authentik-values.yaml
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Raw IAM manifests: key-rotation cronjob + authentik migration job.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: iam-jobs
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/infra/iam
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
# Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
# under Argo, because values changes there were inert — a proxy-body-size fix
# sat committed while the live Ingress kept nginx's 1m default and rejected
# every OCI push with 413.
#
# Wave 3: after databases (wave 2) — Forgejo needs CNPG and Redis up first.
#
# Retiring the Helm release: Argo adopts the existing objects on first sync.
# Delete the release secrets afterwards so helm stops claiming ownership:
#   kubectl -n cicd delete secret -l owner=helm,name=forgejo
#
# automated sync is deliberately absent. This chart owns the Forgejo PVC and
# the git forge itself; the first sync is manual so its diff can be read before
# anything is applied. Turn on automated+selfHeal once that diff is clean.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  sources:
    - repoURL: https://dl.gitea.com/charts/
      chart: gitea
      targetRevision: 12.7.0
      helm:
        valueFiles:
          - $values/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  # Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
  # so the pod rolls when that Secret changes. The chart does not render it, so
  # Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
  # would fight over the field and Recreate the forge each round.
  ignoreDifferences:
    - group: apps
      kind: Deployment
      name: forgejo-gitea
      jqPathExpressions:
        - '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
  syncPolicy:
    syncOptions:
      # Adopt the objects the bootstrap Helm release already created rather
      # than failing on "already exists".
      - ServerSideApply=true
---
# Forgejo runners (local chart, one instance per language), replacing the
# single generic "docker"-labeled runner. Each instance is a full standalone
# Deployment with its own dind sidecar, own PVCs (registration + layer
# cache) and own registered label -- there is no shared generic runner
# anymore, so each instance also builds and pushes images for the repos it
# serves (the chart's ConfigMap/NetworkPolicy fixes for that -- valid_volumes,
# network: host, egress to ingress-nginx -- apply identically to all three).
#
# `values.yaml` is the chart's default and doubles as the golang instance's
# config; node and rust layer a small values-<lang>.yaml override on top for
# just runner.name/runner.labels. All three share one runner-token Secret
# (Forgejo registration tokens are reusable across multiple runners, unlike
# GitHub's one-time tokens) -- if that assumption is ever wrong, registration
# will fail loudly in the register initContainer's logs, not silently.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner-golang
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/infra/forgejo-runner
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner-node
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/infra/forgejo-runner
    helm:
      valueFiles:
        - values-node.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo-runner-rust
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: homelab
  source:
    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
    path: k8s/infra/forgejo-runner
    helm:
      valueFiles:
        - values-rust.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true