feat(bootstrap): Add healthcheck before moving forward

applications/add-ons/cert-manager.yaml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  sources:
+    - repoURL: https://charts.jetstack.io
+      chart: cert-manager
+      targetRevision: v1.19.3
+      helm:
+        values: |
+          crds:
+            enabled: true
+          config:
+            apiVersion: controller.config.cert-manager.io/v1alpha1
+            kind: ControllerConfiguration
+            featureGates:
+              ExperimentalGatewayAPISupport: true
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/add-ons/cert-manager
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/add-ons/cnpg.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cnpg
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  sources:
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      targetRevision: 0.28.2
+      helm:
+        values: |
+          replicaCount: 1
+          config:
+            clusterWide: true
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cluster
+      targetRevision: 0.6.1
+      helm:
+        values: |
+          cluster:
+            instances: 1
+            enablePDB: false
+            storage:
+              size: 500Mi
+          backups:
+            enabled: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/add-ons/sealed-secrets.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sealed-secrets
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  source:
+    repoURL: https://bitnami-labs.github.io/sealed-secrets
+    chart: sealed-secrets
+    targetRevision: 2.18.5
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sealed-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/add-ons/traefik.yaml

@@ -3,10 +3,12 @@ kind: Application
 metadata:
   name: traefik
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   project: default
-  source:
+  sources:
-    repoURL: https://traefik.github.io/charts
+    - repoURL: https://traefik.github.io/charts
       chart: traefik
       targetRevision: v39.0.2
       helm:
@@ -19,12 +21,26 @@ spec:
           service:
             type: ClusterIP
             externalIPs:
-            - 192.168.2.220
+              - 192.168.2.5
           gateway:
             listeners:
               web:
                 namespacePolicy:
                   from: All
+              websecure:
+                port: 8443
+                protocol: HTTPS
+                mode: Terminate
+                hostname: "*.whyredfire.dev"
+                namespacePolicy:
+                  from: All
+                certificateRefs:
+                  - kind: Secret
+                    name: wildcard-whyredfire-dev
+                    group: ""
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/add-ons/traefik
   destination:
     server: https://kubernetes.default.svc
     namespace: traefik

applications/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # add-ons
+  - add-ons/traefik.yaml
+  - add-ons/cert-manager.yaml
+  - add-ons/sealed-secrets.yaml
+  - add-ons/cnpg.yaml
+  # services
+  - services/app-argocd-repos.yaml
+  - services/app-autoregexbot.yaml
+  - services/app-betterslcm.yaml
+  - services/app-jellyfin.yaml
+  - services/app-legislative-summarization.yaml
+  - services/app-scriptscribe.yaml
+  - services/app-seaweedfs.yaml
+  - services/app-qbit.yaml
+  - services/app-stirling-pdf.yaml

applications/services/app-argocd-repos.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd-repos
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+    path: extras/add-ons/argocd-repos
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-autoregexbot.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: telegram-autoregexbot
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-betterslcm.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: betterslcm
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default
@@ -11,7 +13,7 @@ spec:
     path: k8s
   destination:
     server: https://kubernetes.default.svc
-    namespace: slcm
+    namespace: betterslcm
   syncPolicy:
     automated:
       prune: true

applications/services/app-jellyfin.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://jellyfin.github.io/jellyfin-helm
+      chart: jellyfin
+      targetRevision: "2.7.0"
+      helm:
+        values: |
+          service:
+            type: ClusterIP
+            port: 8096
+          ingress:
+            enabled: false
+          persistence:
+            config:
+              enabled: true
+              size: 2Gi
+            media:
+              enabled: true
+              type: hostPath
+              hostPath: /srv/media
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/jellyfin
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: jellyfin
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-legislative-summarization.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: legislative-summarization
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/whyredfire/legislative-summarization
+    targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: legislative-summarization
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-qbit.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: qbit
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
+    targetRevision: main
+    path: qbit
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: qbit
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-scriptscribe.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: scriptscribe
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-seaweedfs.yaml

@@ -0,0 +1,36 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://seaweedfs.github.io/seaweedfs/helm
+      chart: seaweedfs
+      targetRevision: 4.33.0
+      helm:
+        values: |
+          allInOne:
+            enabled: true
+          master:
+            enabled: false
+          volume:
+            enabled: false
+          filer:
+            enabled: false
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/seaweedfs
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: seaweedfs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/services/app-stirling-pdf.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stirling-pdf
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
+      chart: stirling-pdf-chart
+      targetRevision: "3.1.0"
+      helm:
+        values: |
+          fullnameOverride: stirling-pdf
+          persistence:
+            enabled: true
+            size: 512Mi
+          deployment:
+            extraVolumeMounts:
+              - name: storage-volume
+                mountPath: /configs
+          probes:
+            liveness:
+              initialDelaySeconds: 90
+            readiness:
+              initialDelaySeconds: 60
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/stirling-pdf
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stirling-pdf
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

bootstrap/argocd-cm-application-health-patch.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  resource.customizations.health.argoproj.io_Application: |
+    hs = {}
+    hs.status = "Progressing"
+    hs.message = ""
+    if obj.status ~= nil then
+      if obj.status.health ~= nil then
+        hs.status = obj.status.health.status
+        if obj.status.health.message ~= nil then
+          hs.message = obj.status.health.message
+        end
+      end
+    end
+    return hs

bootstrap/argocd-root-app/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
 resources:
   - namespace.yaml
   - root-app.yaml

bootstrap/argocd-root-app/root-app.yaml

@@ -6,11 +6,9 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.whyredfire.tech/whyredfire/gitops.git
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
     path: applications
-    directory:
-      recurse: true
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd

bootstrap/kustomization.yaml

@@ -1,14 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
 namespace: argocd
-
 resources:
   - https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
   - argocd-root-app
-
 patches:
   - target:
       kind: Service
       name: argocd-server
     path: argocd-server-nodeport-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-application-health-patch.yaml

extras/add-ons/argocd-repos/repo-sealed-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-gitops-private
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgCYFWUZmqWTYbutOvQr0GJ87zvVwW/GYanXC4Qdlqo1nkYC0u/ve88UonB0UklJPfMq59/jefbrl80fg4JUMLJMBnNUiIfUIJ2gN07n5P1UqQGTFwo8iHFD4XwKlCfSD75wQXBhccWO1zS1lVZEIzbUdom7rI45bG2Q+u5NQBC/bs3NxrrzYqrHFsbE2jEeu0hG33JOoikvLOwih96Xxgadrvbdw/WpY2bbqM/BSA35u8fzeDF4ZZ98x7LPzflP04DxKJZLh5U3H1//RjWaKeNkDwp/dtNm63NPJrh7+rD+EOHu4undBwNHIW4vrv4bRQeP4xBERNFquiwwmQsi2Wwd4kpD+kgbGhezYMDgk8FOBwS04DJJJpvYdJdGTZoCwML1C+iwMoKhwk7WFvg4vkW3DBpRh+w9Otdq4odsklqgwp1o8OXL1hcd/iQqp8TiuwUFlmJhTs841xvqRMuCBQ0SnAwQ/u9kEsY6C6r/EvdaOciRoEWa0pMk3zvkaCrSkoAElYtXh30MhGfd1rbWT09Xvh/ACRjarBvLHUa7fPSc9Po9t+6eRuFR1cqT2jwUtHMuAqFA4XDC+oHkLsz8WD8qm4K9dwfOXME1rT2OoByaSdlSDsV6uKWRlMxxrzBGzihUBp1TSI8X+ux90hp5vQ30BKqGCC0Y3aRHprndDcHvdP4ASJ6++uu3ZkD6cY/he87w21ETl9+zxo8=
+    type: AgBWyIT44g9RaY/2dyznsXqQ3lVS0q/zJ5MeQhqkREsCn37U8ZxUrVqrmYq+RJU+cPVDWSl2tnmnfjvzV6+SEroVPAaTduRSFYxP6X4xsFuarJ21GSOAvt4Zc1ODZXYxCKfEAB+K7djc+g4+WOp/RihxKue9sevsM2krxnBXouNn7gXOog2Vd7mHbenuuGNVzV6ROJU7tw3uzZ/KETqr+5Jr1bKf64URkcN1njxb9lJHmK+VJbWPLcIbaGCfel07QqX0+EQXjIMwvpHoiWF25dJfPtbADlF/UIjWRXRRh5pCoppXpte39S4nrkkyOKCe2l7IctYF6+pvg5xNOmPeYnqIxpgZwWlWg2TcI5pn4aTxyXA+COJs5VQYgGDxPyNmm2lqh77hzHFceTxlFjtS5u5UQBzjagClXg2lYi2YRcnMTLUHDJyisT9Gr7bpgRK1BU19yxMg5f+vhzL5GmPMtOE6r9dZXwbi5660Okrn7x1MEgHb7poiXbG920yEC3mqVB6+1HLzoY5603b44VafDCTh2AtslSEW8n4Dt1gBm8DAOcDvq1e3NMn8Aq7cyGF5L7x0WwXLjgjr26nf6XiyZ9NAOD2upyJDCZvvVqcFypqOFsFOyhZXU86vuRW35tNqq6N3ppL2OFmm84ies04InHGTJHS3ps8KCyXWow1PgGhn/spB73JSjW4nsUztQPThOQ2c2JY=
+    url: AgDV+GO2ccs/uj87TNXbhSA18Y8amZiqmasZcijd/Zpjv8LPw94f9PORC1v9DhautblXF+Y39MnBjQm3pYLEbIU7FBDpx/Kkk34+F/tTfJqmQOcvGjEZLs73I7kvvy9Uy2Wme/uJt4PpR3UyJEAwJKNudC2NAJz2gfS7lsk+6AUpc+Z6MBoETdUQuaYlk/cxliWnPbJx8EYOS0TEaLezZ27w1OeN2kYEtnZ+qRd/+6g68MpM6UeoL53kOwNOcXN67+IdPE17zD05I0SPIKJy760Ukw/S1sphUpfQgOueHpmgpQanzJWZDCyudLpgnWS/cVWmZY0tDcgmiWCVJwYVFML8Qse3oXWRixIIunhMSS8jFk8Sa/v0agY8SOeIEWIx7n6G6jGkBLK5QZ8Y689UqsfsuKy3aUxno3gqzz4WibjdwAJfNsWCb3P6ZH2AfeTw7gz9HD/AiMRGuSTlzZpGS4acyltwbkKKz1WwLZF/qXtL0hi7QrYIPK82hKF7s458s0KQG2lE+bWOUG0WGjMWys6FwEbe5p3OTT2ea45+OyL0BlFQFkXHeIlxpq86Iz2KVxy4age5SghpSBn3+S3NM4voo9QDIeLXF++EOLCQXRXHgp4vOnb/nAVkbfQ6cvs2HBVg4lSYaNlBlznkPORiUNvXuu2JKHeKzXEJWhwIvmXrnac629MEaCCONEiBaTAy3B08WjSzvWUkxXYuBrRvrcm/JOP8K2yNgtJTRGGbH9SbMTJ8RoqgMC+GjokIFvlButxh0MeXlQLk0huV
+    username: AgBB0XO+j5xoMAgvbIKEf0/ghe9rPwoTnzZvm4lbakuCc4BEKl1Zm5bkNQilEBpxl/TsfnxdhhGnNvF9DXbIJjoEfEU8wzX5LpBMXt5qWC1Oquul4qvEHw6kMCu3oJ7hQ54yBVIhM5W9n1c6UWhJ6ttwZJ/ymqGLFWh1r/3KhoiInfU2EkPJ7bte085rUuyT524mwH9pfGEwte6VjuHPXBQt22i4fP+BBT3pV443PISshGfQC28bpt8vMi83kE/ICkwg21AQUImvfcHXojUJE5dks4mbrA49532R4uDVseVxCrW5fCtevQmgHbkyOke3FQG1AspXx7gdLldKVeW7QBgDP6O9DuEZgNzrxY6T4jf2dNUi1y5W00A4hJVMvIyBy4wENGIj1JJto6D1pRbYPzugKzUhb529UHS6Oxy3H2GqoE5L+mTbrQ2Nm8OhLeaSXUqQtJreZg9GYDZ3sjTe5tlqmcRisM43D5Aw/vV9wu40pRB0OTKM6nIHw1emg/Bq7ZAlZ9S8OpJYitO4SU9J1sOjnI1K3O1QLWB3buGoMnH/1k+Tt7rvYajWyqBM4ODV9O3yN1G9zEEXxzK7sz84JPGAevNJo7fiu8YdaMXhxVywhN43q6PpPQqTdqwQ0muJ5FqJbAzmOiDSQtF18OfpORrKJXVOwD/iFUS4V/6WKqn9HDAc1Dff1CgqJ8IOqxO43Jj4gpvkH2Owzdyf
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repository
+      name: repo-gitops-private
+      namespace: argocd

extras/add-ons/cert-manager/cluster-issuer.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token

extras/add-ons/traefik/wildcard-whyredfire-dev.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-whyredfire-dev
+  namespace: traefik
+spec:
+  secretName: wildcard-whyredfire-dev
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - "*.whyredfire.dev"

extras/services/jellyfin/httproute-local.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jellyfin-local
+  namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
+  hostnames:
+    - jellyfin-local.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: jellyfin
+          port: 8096

extras/services/jellyfin/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
+  hostnames:
+    - jellyfin.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: jellyfin
+          port: 8096

extras/services/seaweedfs/httproute-filer.yaml

@@ -0,0 +1,27 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: seaweedfs-filer
+  namespace: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  hostnames:
+    - seaweedfs.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: seaweedfs-all-in-one
+          port: 8888
+          weight: 1

extras/services/seaweedfs/httproute-master.yaml

@@ -0,0 +1,27 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: seaweedfs-master
+  namespace: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  hostnames:
+    - seaweedfs-master.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: seaweedfs-all-in-one
+          port: 9333
+          weight: 1

extras/services/stirling-pdf/httproute.yaml

@@ -0,0 +1,24 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: stirling-pdf
+  namespace: stirling-pdf
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
+  hostnames:
+    - pdf.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: stirling-pdf
+          port: 8080
+