whyredfire/gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Setup pre-commit hook

Browse Source
This commit is contained in:
whyredfire
2026-08-18 01:04:29 +05:30
parent c30ff48b13
commit b9e2b6c6e8
34 changed files with 276 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.githooks/pre-commit
Executable
+41
View File
@@ -0,0 +1,41 @@
#!/usr/bin/env bash
set -euo pipefail
# Normalise staged manifests to their kubectl kustomize output, so what is
# committed is exactly what Argo CD renders. Requires kubectl and yq.
identity='[.apiVersion, .kind, .metadata.name // ""] | join("|")'
git diff --cached --name-only --diff-filter=ACM -- '*.yaml' |
while IFS= read -r file; do
dir=$(dirname "$file")
name=$(basename "$file")
[ "$name" = kustomization.yaml ] && continue
# only normalise files the sibling kustomization lists as a resource, so
# patches and components are never replaced with build output
yq -r '.resources[]? // ""' "$dir/kustomization.yaml" 2>/dev/null |
grep -Fxq "$name" || continue
rendered=$(mktemp)
kubectl kustomize "$dir" |
yq eval-all "select(($identity) == \"$(yq eval-all "$identity" "$file" | head -1)\")" - >"$rendered"
if [ -s "$rendered" ] && ! diff -q "$file" "$rendered" >/dev/null; then
cat "$rendered" >"$file"
git add "$file"
echo "normalised $file"
fi
rm -f "$rendered"
# normalising may have reverted the change entirely
if git diff --cached --quiet -- "$file"; then
git reset -q HEAD -- "$file"
fi
done
# nothing left staged — prevent an empty commit
if git diff --cached --quiet; then
echo "pre-commit: no meaningful changes, aborting commit"
exit 1
fi
apps/jellyfin/httproute-local.yaml
+11 -11
View File
@@ -1,23 +1,23 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: jellyfin-local
namespace: jellyfin
annotations:
argocd.argoproj.io/sync-wave: "1"
name: jellyfin-local
namespace: jellyfin
spec:
parentRefs:
- name: traefik-gateway
namespace: traefik
kind: Gateway
sectionName: websecure
hostnames:
- jellyfin-local.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- matches:
- backendRefs:
- name: jellyfin
port: 8096
matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: jellyfin
port: 8096
apps/jellyfin/httproute.yaml
+11 -11
View File
@@ -1,23 +1,23 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: jellyfin
namespace: jellyfin
annotations:
argocd.argoproj.io/sync-wave: "1"
name: jellyfin
namespace: jellyfin
spec:
parentRefs:
- name: traefik-gateway
namespace: traefik
kind: Gateway
sectionName: websecure
hostnames:
- jellyfin.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- matches:
- backendRefs:
- name: jellyfin
port: 8096
matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: jellyfin
port: 8096
apps/jellyfin/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- httproute-local.yaml
- httproute.yaml
apps/seaweedfs/httproute-filer.yaml
+9 -9
View File
@@ -1,27 +1,27 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: seaweedfs-filer
namespace: seaweedfs
annotations:
argocd.argoproj.io/sync-wave: "1"
name: seaweedfs-filer
namespace: seaweedfs
spec:
hostnames:
- seaweedfs.whyredfire.dev
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
hostnames:
- seaweedfs.whyredfire.dev
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- backendRefs:
- group: ""
kind: Service
name: seaweedfs-all-in-one
port: 8888
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/seaweedfs/httproute-master.yaml
+9 -9
View File
@@ -1,27 +1,27 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: seaweedfs-master
namespace: seaweedfs
annotations:
argocd.argoproj.io/sync-wave: "1"
name: seaweedfs-master
namespace: seaweedfs
spec:
hostnames:
- seaweedfs-master.whyredfire.dev
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
hostnames:
- seaweedfs-master.whyredfire.dev
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- backendRefs:
- group: ""
kind: Service
name: seaweedfs-all-in-one
port: 9333
weight: 1
matches:
- path:
type: PathPrefix
value: /
apps/seaweedfs/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- httproute-filer.yaml
- httproute-master.yaml
apps/stirling-pdf/anubis-proxy.yaml
+14 -14
View File
@@ -1,24 +1,12 @@
apiVersion: anubis.techaro.dev/v1alpha1
kind: AnubisProxy
metadata:
name: anubis
namespace: stirling-pdf
annotations:
argocd.argoproj.io/sync-wave: "1"
name: anubis
namespace: stirling-pdf
spec:
target:
service:
name: stirling-pdf
port: 8080
anubis:
image:
tag: v1.26.2
keys:
existingSecret: anubis-key
persistence:
enabled: false
metrics:
enabled: false
envExtra:
- name: DIFFICULTY
value: "4"
@@ -42,6 +30,14 @@ spec:
value: "true"
- name: SLOG_LEVEL
value: INFO
image:
tag: v1.26.2
keys:
existingSecret: anubis-key
metrics:
enabled: false
persistence:
enabled: false
resources:
limits:
memory: 128Mi
@@ -50,3 +46,7 @@ spec:
memory: 64Mi
networkPolicy:
enabled: true
target:
service:
name: stirling-pdf
port: 8080
apps/stirling-pdf/httproute.yaml
+11 -12
View File
@@ -1,24 +1,23 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: stirling-pdf
namespace: stirling-pdf
annotations:
argocd.argoproj.io/sync-wave: "2"
name: stirling-pdf
namespace: stirling-pdf
spec:
parentRefs:
- name: traefik-gateway
namespace: traefik
kind: Gateway
sectionName: websecure
hostnames:
- pdf.whyredfire.dev
parentRefs:
- kind: Gateway
name: traefik-gateway
namespace: traefik
sectionName: websecure
rules:
- matches:
- backendRefs:
- name: anubis
port: 80
matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: anubis
port: 80
apps/stirling-pdf/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- anubis-key-sealedsecret.yaml
- anubis-proxy.yaml
- httproute.yaml
argocd-apps/add-ons/anubis-operator.yaml
+8 -8
View File
@@ -1,22 +1,22 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: anubis-operator
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
name: anubis-operator
namespace: argocd
spec:
destination:
namespace: anubis-operator-system
server: https://kubernetes.default.svc
project: default
source:
repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
targetRevision: v0.4.4
path: config/default
kustomize:
images:
- public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
destination:
server: https://kubernetes.default.svc
namespace: anubis-operator-system
path: config/default
repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
targetRevision: v0.4.4
syncPolicy:
automated:
prune: true
argocd-apps/add-ons/argocd-repos.yaml
+6 -6
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: argocd-repos
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
name: argocd-repos
namespace: argocd
spec:
destination:
namespace: argocd
server: https://kubernetes.default.svc
project: default
source:
path: infra/argocd-repos
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
path: infra/argocd-repos
destination:
server: https://kubernetes.default.svc
namespace: argocd
syncPolicy:
automated:
prune: true
argocd-apps/add-ons/cert-manager.yaml
+10 -10
View File
@@ -1,16 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cert-manager
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
name: cert-manager
namespace: argocd
spec:
destination:
namespace: cert-manager
server: https://kubernetes.default.svc
project: default
sources:
- repoURL: https://charts.jetstack.io
chart: cert-manager
targetRevision: v1.21.1
- chart: cert-manager
helm:
values: |
crds:
@@ -20,12 +21,11 @@ spec:
kind: ControllerConfiguration
featureGates:
ExperimentalGatewayAPISupport: true
- repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
repoURL: https://charts.jetstack.io
targetRevision: v1.21.1
- path: infra/cert-manager
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
path: infra/cert-manager
destination:
server: https://kubernetes.default.svc
namespace: cert-manager
syncPolicy:
automated:
prune: true
argocd-apps/add-ons/cnpg.yaml
+7 -7
View File
@@ -1,24 +1,24 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cnpg
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
name: cnpg
namespace: argocd
spec:
destination:
namespace: cnpg-system
server: https://kubernetes.default.svc
project: default
source:
repoURL: https://cloudnative-pg.github.io/charts
chart: cloudnative-pg
targetRevision: 0.29.0
helm:
values: |
replicaCount: 1
config:
clusterWide: true
destination:
server: https://kubernetes.default.svc
namespace: cnpg-system
repoURL: https://cloudnative-pg.github.io/charts
targetRevision: 0.29.0
syncPolicy:
automated:
prune: true
argocd-apps/add-ons/gateway-api.yaml
+6 -6
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: gateway-api
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
name: gateway-api
namespace: argocd
spec:
destination:
namespace: default
server: https://kubernetes.default.svc
project: default
source:
path: config/crd
repoURL: https://github.com/kubernetes-sigs/gateway-api.git
targetRevision: v1.6.1
path: config/crd
destination:
server: https://kubernetes.default.svc
namespace: default
syncPolicy:
automated:
prune: true
argocd-apps/add-ons/kustomization.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- anubis-operator.yaml
- argocd-repos.yaml
- cert-manager.yaml
- cnpg.yaml
- gateway-api.yaml
- sealed-secrets.yaml
- traefik.yaml
argocd-apps/add-ons/sealed-secrets.yaml
+6 -6
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: sealed-secrets
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
name: sealed-secrets
namespace: argocd
spec:
destination:
namespace: sealed-secrets
server: https://kubernetes.default.svc
project: default
source:
repoURL: https://bitnami.github.io/sealed-secrets
chart: sealed-secrets
repoURL: https://bitnami.github.io/sealed-secrets
targetRevision: 2.19.1
destination:
server: https://kubernetes.default.svc
namespace: sealed-secrets
syncPolicy:
automated:
prune: true
argocd-apps/add-ons/traefik.yaml
+10 -10
View File
@@ -1,16 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: traefik
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
name: traefik
namespace: argocd
spec:
destination:
namespace: traefik
server: https://kubernetes.default.svc
project: default
sources:
- repoURL: https://traefik.github.io/charts
chart: traefik
targetRevision: 41.2.0
- chart: traefik
helm:
values: |
providers:
@@ -39,12 +40,11 @@ spec:
- kind: Secret
name: wildcard-whyredfire-dev
group: ""
- repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
repoURL: https://traefik.github.io/charts
targetRevision: 41.2.0
- path: infra/traefik
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
path: infra/traefik
destination:
server: https://kubernetes.default.svc
namespace: traefik
syncPolicy:
automated:
prune: true
argocd-apps/kustomization.yaml
+2 -17
View File
@@ -1,20 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
# add-ons
- add-ons/gateway-api.yaml
- add-ons/traefik.yaml
- add-ons/cert-manager.yaml
- add-ons/anubis-operator.yaml
- add-ons/sealed-secrets.yaml
- add-ons/cnpg.yaml
- add-ons/argocd-repos.yaml
# services
- services/autoregexbot.yaml
- services/betterslcm.yaml
- services/jellyfin.yaml
- services/legislative-summarization.yaml
- services/scriptscribe.yaml
- services/seaweedfs.yaml
- services/qbit.yaml
- services/stirling-pdf.yaml
- add-ons
- services
argocd-apps/services/autoregexbot.yaml
+5 -5
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: telegram-autoregexbot
annotations:
argocd.argoproj.io/sync-wave: "3"
name: telegram-autoregexbot
namespace: argocd
spec:
destination:
namespace: telegram-bot
server: https://kubernetes.default.svc
project: default
source:
path: k8s
repoURL: https://github.com/santarl/telegram-autoregexbot
targetRevision: main
path: k8s
destination:
server: https://kubernetes.default.svc
namespace: telegram-bot
syncPolicy:
automated:
prune: true
argocd-apps/services/betterslcm.yaml
+5 -5
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: betterslcm
annotations:
argocd.argoproj.io/sync-wave: "3"
name: betterslcm
namespace: argocd
spec:
destination:
namespace: betterslcm
server: https://kubernetes.default.svc
project: default
source:
path: k8s
repoURL: https://github.com/DK10WS/SLCM_APP.git
targetRevision: web
path: k8s
destination:
server: https://kubernetes.default.svc
namespace: betterslcm
syncPolicy:
automated:
prune: true
argocd-apps/services/jellyfin.yaml
+9 -9
View File
@@ -1,16 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: jellyfin
annotations:
argocd.argoproj.io/sync-wave: "3"
name: jellyfin
namespace: argocd
spec:
destination:
namespace: jellyfin
server: https://kubernetes.default.svc
project: default
sources:
- repoURL: https://jellyfin.github.io/jellyfin-helm
chart: jellyfin
targetRevision: "2.7.0"
- chart: jellyfin
helm:
values: |
service:
@@ -26,12 +27,11 @@ spec:
enabled: true
type: hostPath
hostPath: /srv/media
- repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
repoURL: https://jellyfin.github.io/jellyfin-helm
targetRevision: 2.7.0
- path: apps/jellyfin
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
path: apps/jellyfin
destination:
server: https://kubernetes.default.svc
namespace: jellyfin
syncPolicy:
automated:
prune: true
argocd-apps/services/kustomization.yaml
+11
View File
@@ -0,0 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- autoregexbot.yaml
- betterslcm.yaml
- jellyfin.yaml
- legislative-summarization.yaml
- qbit.yaml
- scriptscribe.yaml
- seaweedfs.yaml
- stirling-pdf.yaml
argocd-apps/services/legislative-summarization.yaml
+5 -5
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: legislative-summarization
annotations:
argocd.argoproj.io/sync-wave: "3"
name: legislative-summarization
namespace: argocd
spec:
destination:
namespace: legislative-summarization
server: https://kubernetes.default.svc
project: default
source:
path: k8s
repoURL: https://github.com/whyredfire/legislative-summarization
targetRevision: main
path: k8s
destination:
server: https://kubernetes.default.svc
namespace: legislative-summarization
syncPolicy:
automated:
prune: true
argocd-apps/services/qbit.yaml
+5 -5
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: qbit
annotations:
argocd.argoproj.io/sync-wave: "3"
name: qbit
namespace: argocd
spec:
destination:
namespace: qbit
server: https://kubernetes.default.svc
project: default
source:
path: qbit
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
targetRevision: main
path: qbit
destination:
server: https://kubernetes.default.svc
namespace: qbit
syncPolicy:
automated:
prune: true
argocd-apps/services/scriptscribe.yaml
+5 -5
View File
@@ -1,19 +1,19 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: scriptscribe
annotations:
argocd.argoproj.io/sync-wave: "3"
name: scriptscribe
namespace: argocd
spec:
destination:
namespace: scriptscribe
server: https://kubernetes.default.svc
project: default
source:
path: k8s
repoURL: https://github.com/whyredfire/scriptscribe
targetRevision: main
path: k8s
destination:
server: https://kubernetes.default.svc
namespace: scriptscribe
syncPolicy:
automated:
prune: true
argocd-apps/services/seaweedfs.yaml
+9 -9
View File
@@ -1,16 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: seaweedfs
annotations:
argocd.argoproj.io/sync-wave: "3"
name: seaweedfs
namespace: argocd
spec:
destination:
namespace: seaweedfs
server: https://kubernetes.default.svc
project: default
sources:
- repoURL: https://seaweedfs.github.io/seaweedfs/helm
chart: seaweedfs
targetRevision: 4.33.0
- chart: seaweedfs
helm:
values: |
allInOne:
@@ -21,12 +22,11 @@ spec:
enabled: false
filer:
enabled: false
- repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
repoURL: https://seaweedfs.github.io/seaweedfs/helm
targetRevision: 4.33.0
- path: apps/seaweedfs
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
path: apps/seaweedfs
destination:
server: https://kubernetes.default.svc
namespace: seaweedfs
syncPolicy:
automated:
prune: true
argocd-apps/services/stirling-pdf.yaml
+9 -9
View File
@@ -1,16 +1,17 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: stirling-pdf
annotations:
argocd.argoproj.io/sync-wave: "3"
name: stirling-pdf
namespace: argocd
spec:
destination:
namespace: stirling-pdf
server: https://kubernetes.default.svc
project: default
sources:
- repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
chart: stirling-pdf-chart
targetRevision: "3.1.0"
- chart: stirling-pdf-chart
helm:
values: |
fullnameOverride: stirling-pdf
@@ -26,12 +27,11 @@ spec:
initialDelaySeconds: 90
readiness:
initialDelaySeconds: 60
- repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
targetRevision: 3.1.0
- path: apps/stirling-pdf
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
path: apps/stirling-pdf
destination:
server: https://kubernetes.default.svc
namespace: stirling-pdf
syncPolicy:
automated:
prune: true
bootstrap/argocd-root-app/root-app.yaml
+4 -4
View File
@@ -4,14 +4,14 @@ metadata:
name: root-app
namespace: argocd
spec:
destination:
namespace: argocd
server: https://kubernetes.default.svc
project: default
source:
path: argocd-apps
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
targetRevision: main
path: argocd-apps
destination:
server: https://kubernetes.default.svc
namespace: argocd
syncPolicy:
automated:
prune: true
infra/argocd-repos/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- repo-sealed-secret.yaml
infra/cert-manager/cluster-issuer.yaml
+3 -3
View File
@@ -1,18 +1,18 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
annotations:
argocd.argoproj.io/sync-wave: "1"
name: letsencrypt-prod
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: [email protected]
privateKeySecretRef:
name: letsencrypt-prod
server: https://acme-v02.api.letsencrypt.org/directory
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cloudflare-api-token
key: api-token
name: cloudflare-api-token
infra/cert-manager/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- cloudflare-api-token-sealed-secret.yaml
- cluster-issuer.yaml
infra/traefik/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- wildcard-whyredfire-dev.yaml
infra/traefik/wildcard-whyredfire-dev.yaml
+6 -6
View File
@@ -4,11 +4,11 @@ metadata:
name: wildcard-whyredfire-dev
namespace: traefik
spec:
secretName: wildcard-whyredfire-dev
dnsNames:
- '*.whyredfire.dev'
issuerRef:
kind: ClusterIssuer
name: letsencrypt-prod
privateKey:
rotationPolicy: Always
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
dnsNames:
- "*.whyredfire.dev"
secretName: wildcard-whyredfire-dev