feat(sealed-secrets): Update repoURL and add CF token

applications/add-ons/cert-manager.yaml

@@ -3,6 +3,8 @@ kind: Application
 metadata:
   name: cert-manager
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   project: default
   sources:

applications/add-ons/cnpg.yaml

@@ -3,6 +3,8 @@ kind: Application
 metadata:
   name: cnpg
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
 spec:
   project: default
   sources:

applications/add-ons/sealed-secrets.yaml

@@ -3,10 +3,12 @@ kind: Application
 metadata:
   name: sealed-secrets
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
 spec:
   project: default
   source:
-    repoURL: https://bitnami-labs.github.io/sealed-secrets
+    repoURL: https://bitnami.github.io/sealed-secrets
     chart: sealed-secrets
     targetRevision: 2.18.5
   destination:

applications/add-ons/traefik.yaml

@@ -3,39 +3,44 @@ kind: Application
 metadata:
   name: traefik
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   project: default
-  source:
-    repoURL: https://traefik.github.io/charts
-    chart: traefik
-    targetRevision: v39.0.2
-    helm:
-      values: |
-        providers:
-          kubernetesGateway:
-            enabled: true
-          kubernetesIngress:
-            enabled: false
-        service:
-          type: ClusterIP
-          externalIPs:
-            - 192.168.2.5
-        gateway:
-          listeners:
-            web:
-              namespacePolicy:
-                from: All
-            websecure:
-              port: 8443
-              protocol: HTTPS
-              mode: Terminate
-              hostname: "*.whyredfire.dev"
-              namespacePolicy:
-                from: All
-              certificateRefs:
-                - kind: Secret
-                  name: wildcard-whyredfire-dev
-                  group: ""
+  sources:
+    - repoURL: https://traefik.github.io/charts
+      chart: traefik
+      targetRevision: v39.0.2
+      helm:
+        values: |
+          providers:
+            kubernetesGateway:
+              enabled: true
+            kubernetesIngress:
+              enabled: false
+          service:
+            type: ClusterIP
+            externalIPs:
+              - 192.168.2.5
+          gateway:
+            listeners:
+              web:
+                namespacePolicy:
+                  from: All
+              websecure:
+                port: 8443
+                protocol: HTTPS
+                mode: Terminate
+                hostname: "*.whyredfire.dev"
+                namespacePolicy:
+                  from: All
+                certificateRefs:
+                  - kind: Secret
+                    name: wildcard-whyredfire-dev
+                    group: ""
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/add-ons/traefik
   destination:
     server: https://kubernetes.default.svc
     namespace: traefik

applications/services/app-argocd-repos.yaml

@@ -3,6 +3,8 @@ kind: Application
 metadata:
   name: argocd-repos
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   project: default
   source:

applications/services/app-autoregexbot.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: telegram-autoregexbot
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-betterslcm.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: betterslcm
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-jellyfin.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-legislative-summarization.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: legislative-summarization
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-qbit.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: qbit
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-scriptscribe.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: scriptscribe
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-seaweedfs.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-stirling-pdf.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: stirling-pdf
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

bootstrap/argocd-cm-application-health-patch.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  resource.customizations.health.argoproj.io_Application: |
+    hs = {}
+    hs.status = "Progressing"
+    hs.message = ""
+    if obj.status ~= nil then
+      if obj.status.health ~= nil then
+        hs.status = obj.status.health.status
+        if obj.status.health.message ~= nil then
+          hs.message = obj.status.health.message
+        end
+      end
+    end
+    return hs

bootstrap/kustomization.yaml

@@ -9,3 +9,7 @@ patches:
       kind: Service
       name: argocd-server
     path: argocd-server-nodeport-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-application-health-patch.yaml

extras/add-ons/cert-manager/cloudflare-api-token-sealed-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgAWGbxZBGrznQxIKfKmKEqAwNKY025ojuhr1l2vgoj/dBJ3vxpKX2tYAxZse5gu+G5CiI+130atGPCqJxGB0oRTbeTi9Zyxhw+FclxGMcXrfqZtXVUANrNUmpVZMgMF5pzd04rY9WdvK9tQiXnDp4SayzpRpzoHgln5gvTeLaArOQ3NC/2Nx/Ka+ImFUvxPvCI8H3ANXuRlk3dFfnLN8Uwj3NXWmsmTphq4hDzHXc0IWoV26MFwoKftjfVlirlKbP4LBCp65mXdluu3/EsuA0P2AS2S0RkFAucBPCPe2z24bivMZgn61KBGIJJ/waJITQ5CfYMPWwzDhNuabdosNKW0HejIy5cYZxMOBTz1t8xGYhOBsNB3t3KbyOqE9qxDxdZqiPQbvM3zyagRPaucHt15tjUqEzHymi0GGFToixRcnlQAdVrxmcb6JRe7eVrful/PNB3rG29DEuiCbXDOfMPbScjDkxNpKgQTAXnhRaPrjR49dpW0pkNABn11DcU4RsckelfD5cdxt+E0Oe/P8nKcglrgHMFZLSV30JGT+WEv2xx1M7VFz7NdxyrB0K8f8/hf3f5lEEHqTzPfaWQUIL7ZBIOqbtqvlnlx0m70QOzkeMUQdTO5jo1MoZy7MgomOCGPAaXUhDrDtxYCgipmMIbjCo6RokS86YlvqE9BNTpxt1LXX6p0rLKTiN0JeumLTU0rmdvMBxP1dH0LyTd9GWrNvbX8ve6ikbPTo7xAPG9KwlO5M4pY9MJP
+  template:
+    metadata:
+      name: cloudflare-api-token
+      namespace: cert-manager
+    type: Opaque

extras/add-ons/cert-manager/cluster-issuer.yaml

@@ -2,6 +2,8 @@ apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   acme:
     server: https://acme-v02.api.letsencrypt.org/directory

extras/services/jellyfin/httproute-local.yaml

@@ -3,6 +3,8 @@ kind: HTTPRoute
 metadata:
   name: jellyfin-local
   namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   parentRefs:
     - name: traefik-gateway

extras/services/jellyfin/httproute.yaml

@@ -3,6 +3,8 @@ kind: HTTPRoute
 metadata:
   name: jellyfin
   namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   parentRefs:
     - name: traefik-gateway

extras/services/seaweedfs/httproute-filer.yaml

@@ -3,6 +3,8 @@ kind: HTTPRoute
 metadata:
   name: seaweedfs-filer
   namespace: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   parentRefs:
     - group: gateway.networking.k8s.io

extras/services/seaweedfs/httproute-master.yaml

@@ -3,6 +3,8 @@ kind: HTTPRoute
 metadata:
   name: seaweedfs-master
   namespace: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   parentRefs:
     - group: gateway.networking.k8s.io

extras/services/stirling-pdf/httproute.yaml

@@ -3,6 +3,8 @@ kind: HTTPRoute
 metadata:
   name: stirling-pdf
   namespace: stirling-pdf
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   parentRefs:
     - name: traefik-gateway