feat: Setup pre-commit hook

.githooks/pre-commit

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Normalise staged manifests to their kubectl kustomize output, so what is
+# committed is exactly what Argo CD renders. Requires kubectl and yq.
+
+identity='[.apiVersion, .kind, .metadata.name // ""] | join("|")'
+
+git diff --cached --name-only --diff-filter=ACM -- '*.yaml' |
+  while IFS= read -r file; do
+    dir=$(dirname "$file")
+    name=$(basename "$file")
+    [ "$name" = kustomization.yaml ] && continue
+
+    # only normalise files the sibling kustomization lists as a resource, so
+    # patches and components are never replaced with build output
+    yq -r '.resources[]? // ""' "$dir/kustomization.yaml" 2>/dev/null |
+      grep -Fxq "$name" || continue
+
+    rendered=$(mktemp)
+    kubectl kustomize "$dir" |
+      yq eval-all "select(($identity) == \"$(yq eval-all "$identity" "$file" | head -1)\")" - >"$rendered"
+
+    if [ -s "$rendered" ] && ! diff -q "$file" "$rendered" >/dev/null; then
+      cat "$rendered" >"$file"
+      git add "$file"
+      echo "normalised $file"
+    fi
+    rm -f "$rendered"
+
+    # normalising may have reverted the change entirely
+    if git diff --cached --quiet -- "$file"; then
+      git reset -q HEAD -- "$file"
+    fi
+  done
+
+# nothing left staged — prevent an empty commit
+if git diff --cached --quiet; then
+  echo "pre-commit: no meaningful changes, aborting commit"
+  exit 1
+fi

apps/jellyfin/httproute-local.yaml

@@ -1,23 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: jellyfin-local
-  namespace: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: jellyfin-local
+  namespace: jellyfin
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - jellyfin-local.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: jellyfin
+          port: 8096
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: jellyfin
-          port: 8096

apps/jellyfin/httproute.yaml

@@ -1,23 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: jellyfin
-  namespace: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: jellyfin
+  namespace: jellyfin
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - jellyfin.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: jellyfin
+          port: 8096
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: jellyfin
-          port: 8096

apps/jellyfin/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - httproute-local.yaml
+  - httproute.yaml

apps/seaweedfs/httproute-filer.yaml

@@ -1,27 +1,27 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: seaweedfs-filer
-  namespace: seaweedfs
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: seaweedfs-filer
+  namespace: seaweedfs
 spec:
+  hostnames:
+    - seaweedfs.whyredfire.dev
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: traefik-gateway
       namespace: traefik
       sectionName: websecure
-  hostnames:
-    - seaweedfs.whyredfire.dev
   rules:
-    - matches:
+    - backendRefs:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
         - group: ""
           kind: Service
           name: seaweedfs-all-in-one
           port: 8888
           weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/seaweedfs/httproute-master.yaml

@@ -1,27 +1,27 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: seaweedfs-master
-  namespace: seaweedfs
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: seaweedfs-master
+  namespace: seaweedfs
 spec:
+  hostnames:
+    - seaweedfs-master.whyredfire.dev
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: traefik-gateway
       namespace: traefik
       sectionName: websecure
-  hostnames:
-    - seaweedfs-master.whyredfire.dev
   rules:
-    - matches:
+    - backendRefs:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
         - group: ""
           kind: Service
           name: seaweedfs-all-in-one
           port: 9333
           weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/seaweedfs/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - httproute-filer.yaml
+  - httproute-master.yaml

apps/stirling-pdf/anubis-proxy.yaml

@@ -1,24 +1,12 @@
 apiVersion: anubis.techaro.dev/v1alpha1
 kind: AnubisProxy
 metadata:
-  name: anubis
-  namespace: stirling-pdf
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: anubis
+  namespace: stirling-pdf
 spec:
-  target:
-    service:
-      name: stirling-pdf
-      port: 8080
   anubis:
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    persistence:
-      enabled: false
-    metrics:
-      enabled: false
     envExtra:
       - name: DIFFICULTY
         value: "4"
@@ -42,6 +30,14 @@ spec:
         value: "true"
       - name: SLOG_LEVEL
         value: INFO
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
     resources:
       limits:
         memory: 128Mi
@@ -50,3 +46,7 @@ spec:
         memory: 64Mi
   networkPolicy:
     enabled: true
+  target:
+    service:
+      name: stirling-pdf
+      port: 8080

apps/stirling-pdf/httproute.yaml

@@ -1,24 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: stirling-pdf
-  namespace: stirling-pdf
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+  name: stirling-pdf
+  namespace: stirling-pdf
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - pdf.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: anubis
+          port: 80
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: anubis
-          port: 80
-

apps/stirling-pdf/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - anubis-key-sealedsecret.yaml
+  - anubis-proxy.yaml
+  - httproute.yaml

argocd-apps/add-ons/anubis-operator.yaml

@@ -1,22 +1,22 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: anubis-operator
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: anubis-operator
+  namespace: argocd
 spec:
+  destination:
+    namespace: anubis-operator-system
+    server: https://kubernetes.default.svc
   project: default
   source:
-    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
-    targetRevision: v0.4.4
-    path: config/default
     kustomize:
       images:
         - public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
-  destination:
+    path: config/default
-    server: https://kubernetes.default.svc
+    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
-    namespace: anubis-operator-system
+    targetRevision: v0.4.4
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/argocd-repos.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: argocd-repos
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: argocd-repos
+  namespace: argocd
 spec:
+  destination:
+    namespace: argocd
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: infra/argocd-repos
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
-    path: infra/argocd-repos
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/cert-manager.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cert-manager
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: cert-manager
+  namespace: argocd
 spec:
+  destination:
+    namespace: cert-manager
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://charts.jetstack.io
+    - chart: cert-manager
-      chart: cert-manager
-      targetRevision: v1.21.1
       helm:
         values: |
           crds:
@@ -20,12 +21,11 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://charts.jetstack.io
+      targetRevision: v1.21.1
+    - path: infra/cert-manager
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: infra/cert-manager
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: cert-manager
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/cnpg.yaml

@@ -1,24 +1,24 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cnpg
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "0"
+  name: cnpg
+  namespace: argocd
 spec:
+  destination:
+    namespace: cnpg-system
+    server: https://kubernetes.default.svc
   project: default
   source:
-    repoURL: https://cloudnative-pg.github.io/charts
     chart: cloudnative-pg
-    targetRevision: 0.29.0
     helm:
       values: |
         replicaCount: 1
         config:
           clusterWide: true
-  destination:
+    repoURL: https://cloudnative-pg.github.io/charts
-    server: https://kubernetes.default.svc
+    targetRevision: 0.29.0
-    namespace: cnpg-system
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/gateway-api.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: gateway-api
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "0"
+  name: gateway-api
+  namespace: argocd
 spec:
+  destination:
+    namespace: default
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: config/crd
     repoURL: https://github.com/kubernetes-sigs/gateway-api.git
     targetRevision: v1.6.1
-    path: config/crd
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - anubis-operator.yaml
+  - argocd-repos.yaml
+  - cert-manager.yaml
+  - cnpg.yaml
+  - gateway-api.yaml
+  - sealed-secrets.yaml
+  - traefik.yaml

argocd-apps/add-ons/sealed-secrets.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: sealed-secrets
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "0"
+  name: sealed-secrets
+  namespace: argocd
 spec:
+  destination:
+    namespace: sealed-secrets
+    server: https://kubernetes.default.svc
   project: default
   source:
-    repoURL: https://bitnami.github.io/sealed-secrets
     chart: sealed-secrets
+    repoURL: https://bitnami.github.io/sealed-secrets
     targetRevision: 2.19.1
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: sealed-secrets
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/traefik.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: traefik
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+  name: traefik
+  namespace: argocd
 spec:
+  destination:
+    namespace: traefik
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://traefik.github.io/charts
+    - chart: traefik
-      chart: traefik
-      targetRevision: 41.2.0
       helm:
         values: |
           providers:
@@ -39,12 +40,11 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dev
                     group: ""
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://traefik.github.io/charts
+      targetRevision: 41.2.0
+    - path: infra/traefik
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: infra/traefik
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: traefik
   syncPolicy:
     automated:
       prune: true

argocd-apps/kustomization.yaml

@@ -1,20 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # add-ons
+  - add-ons
-  - add-ons/gateway-api.yaml
+  - services
-  - add-ons/traefik.yaml
-  - add-ons/cert-manager.yaml
-  - add-ons/anubis-operator.yaml
-  - add-ons/sealed-secrets.yaml
-  - add-ons/cnpg.yaml
-  - add-ons/argocd-repos.yaml
-  # services
-  - services/autoregexbot.yaml
-  - services/betterslcm.yaml
-  - services/jellyfin.yaml
-  - services/legislative-summarization.yaml
-  - services/scriptscribe.yaml
-  - services/seaweedfs.yaml
-  - services/qbit.yaml
-  - services/stirling-pdf.yaml

argocd-apps/services/autoregexbot.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: telegram-autoregexbot
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: telegram-autoregexbot
   namespace: argocd
 spec:
+  destination:
+    namespace: telegram-bot
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/santarl/telegram-autoregexbot
     targetRevision: main
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: telegram-bot
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/betterslcm.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: betterslcm
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: betterslcm
   namespace: argocd
 spec:
+  destination:
+    namespace: betterslcm
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/DK10WS/SLCM_APP.git
     targetRevision: web
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: betterslcm
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/jellyfin.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: jellyfin
   namespace: argocd
 spec:
+  destination:
+    namespace: jellyfin
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://jellyfin.github.io/jellyfin-helm
+    - chart: jellyfin
-      chart: jellyfin
-      targetRevision: "2.7.0"
       helm:
         values: |
           service:
@@ -26,12 +27,11 @@ spec:
               enabled: true
               type: hostPath
               hostPath: /srv/media
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://jellyfin.github.io/jellyfin-helm
+      targetRevision: 2.7.0
+    - path: apps/jellyfin
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: apps/jellyfin
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: jellyfin
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - autoregexbot.yaml
+  - betterslcm.yaml
+  - jellyfin.yaml
+  - legislative-summarization.yaml
+  - qbit.yaml
+  - scriptscribe.yaml
+  - seaweedfs.yaml
+  - stirling-pdf.yaml

argocd-apps/services/legislative-summarization.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: legislative-summarization
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: legislative-summarization
   namespace: argocd
 spec:
+  destination:
+    namespace: legislative-summarization
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/whyredfire/legislative-summarization
     targetRevision: main
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: legislative-summarization
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/qbit.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: qbit
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: qbit
   namespace: argocd
 spec:
+  destination:
+    namespace: qbit
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: qbit
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
     targetRevision: main
-    path: qbit
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: qbit
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/scriptscribe.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: scriptscribe
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: scriptscribe
   namespace: argocd
 spec:
+  destination:
+    namespace: scriptscribe
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/whyredfire/scriptscribe
     targetRevision: main
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: scriptscribe
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/seaweedfs.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: seaweedfs
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: seaweedfs
   namespace: argocd
 spec:
+  destination:
+    namespace: seaweedfs
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://seaweedfs.github.io/seaweedfs/helm
+    - chart: seaweedfs
-      chart: seaweedfs
-      targetRevision: 4.33.0
       helm:
         values: |
           allInOne:
@@ -21,12 +22,11 @@ spec:
             enabled: false
           filer:
             enabled: false
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://seaweedfs.github.io/seaweedfs/helm
+      targetRevision: 4.33.0
+    - path: apps/seaweedfs
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: apps/seaweedfs
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: seaweedfs
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/stirling-pdf.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: stirling-pdf
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: stirling-pdf
   namespace: argocd
 spec:
+  destination:
+    namespace: stirling-pdf
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
+    - chart: stirling-pdf-chart
-      chart: stirling-pdf-chart
-      targetRevision: "3.1.0"
       helm:
         values: |
           fullnameOverride: stirling-pdf
@@ -26,12 +27,11 @@ spec:
               initialDelaySeconds: 90
             readiness:
               initialDelaySeconds: 60
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
+      targetRevision: 3.1.0
+    - path: apps/stirling-pdf
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: apps/stirling-pdf
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: stirling-pdf
   syncPolicy:
     automated:
       prune: true

bootstrap/argocd-root-app/root-app.yaml

@@ -4,14 +4,14 @@ metadata:
   name: root-app
   namespace: argocd
 spec:
+  destination:
+    namespace: argocd
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: argocd-apps
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
-    path: argocd-apps
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
   syncPolicy:
     automated:
       prune: true

infra/argocd-repos/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - repo-sealed-secret.yaml

infra/cert-manager/cluster-issuer.yaml

@@ -1,18 +1,18 @@
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: letsencrypt-prod
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: letsencrypt-prod
 spec:
   acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
     email: [email protected]
     privateKeySecretRef:
       name: letsencrypt-prod
+    server: https://acme-v02.api.letsencrypt.org/directory
     solvers:
       - dns01:
           cloudflare:
             apiTokenSecretRef:
-              name: cloudflare-api-token
               key: api-token
+              name: cloudflare-api-token

infra/cert-manager/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cloudflare-api-token-sealed-secret.yaml
+  - cluster-issuer.yaml

infra/traefik/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - wildcard-whyredfire-dev.yaml

infra/traefik/wildcard-whyredfire-dev.yaml

@@ -4,11 +4,11 @@ metadata:
   name: wildcard-whyredfire-dev
   namespace: traefik
 spec:
-  secretName: wildcard-whyredfire-dev
+  dnsNames:
+    - '*.whyredfire.dev'
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
   privateKey:
     rotationPolicy: Always
-  issuerRef:
+  secretName: wildcard-whyredfire-dev
-    name: letsencrypt-prod
-    kind: ClusterIssuer
-  dnsNames:
-    - "*.whyredfire.dev"