feat(bootstrap): Add healthcheck before moving forward

{"grpc.code":"Unknown","grpc.component":"server","grpc.error":"failed to list refs: unexpected client error: unexpected requesting \"https://gitlab.com/whyredfire/gitops/info/refs?service=git-upload-pack\" status code: 301","grpc.method":"GenerateManifest","grpc.method_type":"unary","grpc.request.deadline":"2026-01-26T14:31:42Z","grpc.service":"repository.RepoServerService","grpc.start_time":"2026-01-26T14:30:42Z","grpc.time_ms":"883.443","level":"error","msg":"finished call","peer.address":"10.42.0.30:49920","protocol":"grpc","time":"2026-01-26T14:30:43Z"}

applications/add-ons/cert-manager.yaml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  sources:
+    - repoURL: https://charts.jetstack.io
+      chart: cert-manager
+      targetRevision: v1.19.3
+      helm:
+        values: |
+          crds:
+            enabled: true
+          config:
+            apiVersion: controller.config.cert-manager.io/v1alpha1
+            kind: ControllerConfiguration
+            featureGates:
+              ExperimentalGatewayAPISupport: true
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/add-ons/cert-manager
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/add-ons/cnpg.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cnpg
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  sources:
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      targetRevision: 0.28.2
+      helm:
+        values: |
+          replicaCount: 1
+          config:
+            clusterWide: true
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cluster
+      targetRevision: 0.6.1
+      helm:
+        values: |
+          cluster:
+            instances: 1
+            enablePDB: false
+            storage:
+              size: 500Mi
+          backups:
+            enabled: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/add-ons/sealed-secrets.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sealed-secrets
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  source:
+    repoURL: https://bitnami-labs.github.io/sealed-secrets
+    chart: sealed-secrets
+    targetRevision: 2.18.5
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sealed-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/add-ons/traefik.yaml

@@ -0,0 +1,53 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    - repoURL: https://traefik.github.io/charts
+      chart: traefik
+      targetRevision: v39.0.2
+      helm:
+        values: |
+          providers:
+            kubernetesGateway:
+              enabled: true
+            kubernetesIngress:
+              enabled: false
+          service:
+            type: ClusterIP
+            externalIPs:
+              - 192.168.2.5
+          gateway:
+            listeners:
+              web:
+                namespacePolicy:
+                  from: All
+              websecure:
+                port: 8443
+                protocol: HTTPS
+                mode: Terminate
+                hostname: "*.whyredfire.dev"
+                namespacePolicy:
+                  from: All
+                certificateRefs:
+                  - kind: Secret
+                    name: wildcard-whyredfire-dev
+                    group: ""
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/add-ons/traefik
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # add-ons
+  - add-ons/traefik.yaml
+  - add-ons/cert-manager.yaml
+  - add-ons/sealed-secrets.yaml
+  - add-ons/cnpg.yaml
+  # services
+  - services/app-argocd-repos.yaml
+  - services/app-autoregexbot.yaml
+  - services/app-betterslcm.yaml
+  - services/app-jellyfin.yaml
+  - services/app-legislative-summarization.yaml
+  - services/app-scriptscribe.yaml
+  - services/app-seaweedfs.yaml
+  - services/app-qbit.yaml
+  - services/app-stirling-pdf.yaml

applications/services/app-argocd-repos.yaml

@@ -1,17 +1,22 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: sealed-secrets
+  name: argocd-repos
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   project: default
   source:
-    repoURL: https://gitea.whyredfire.tech/whyredfire/gitops
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
-    path: infra/sealed-secrets
+    path: extras/add-ons/argocd-repos
   destination:
     server: https://kubernetes.default.svc
+    namespace: argocd
   syncPolicy:
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-autoregexbot.yaml

@@ -2,16 +2,18 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: telegram-autoregexbot
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitea.whyredfire.tech/whyredfire/telegram-autoregexbot
+    repoURL: https://github.com/santarl/telegram-autoregexbot
     targetRevision: main
     path: k8s
   destination:
     server: https://kubernetes.default.svc
-    namespace: telegram
+    namespace: telegram-bot
   syncPolicy:
     automated:
       prune: true

applications/services/app-betterslcm.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: betterslcm
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/DK10WS/SLCM_APP.git
+    targetRevision: web
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: betterslcm
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-jellyfin.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://jellyfin.github.io/jellyfin-helm
+      chart: jellyfin
+      targetRevision: "2.7.0"
+      helm:
+        values: |
+          service:
+            type: ClusterIP
+            port: 8096
+          ingress:
+            enabled: false
+          persistence:
+            config:
+              enabled: true
+              size: 2Gi
+            media:
+              enabled: true
+              type: hostPath
+              hostPath: /srv/media
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/jellyfin
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: jellyfin
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-legislative-summarization.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: legislative-summarization
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/whyredfire/legislative-summarization
+    targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: legislative-summarization
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

applications/services/app-qbit.yaml

@@ -1,17 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: nginx
+  name: qbit
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default
   source:
-    repoURL: https://gitea.whyredfire.tech/whyredfire/gitops
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
     targetRevision: main
-    path: manifests/nginx
+    path: qbit
   destination:
     server: https://kubernetes.default.svc
-    namespace: nginx
+    namespace: qbit
   syncPolicy:
     automated:
       prune: true

applications/services/app-scriptscribe.yaml

@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: scriptscribe
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
   namespace: argocd
 spec:
   project: default

applications/services/app-seaweedfs.yaml

@@ -0,0 +1,36 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://seaweedfs.github.io/seaweedfs/helm
+      chart: seaweedfs
+      targetRevision: 4.33.0
+      helm:
+        values: |
+          allInOne:
+            enabled: true
+          master:
+            enabled: false
+          volume:
+            enabled: false
+          filer:
+            enabled: false
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/seaweedfs
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: seaweedfs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/services/app-stirling-pdf.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stirling-pdf
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
+      chart: stirling-pdf-chart
+      targetRevision: "3.1.0"
+      helm:
+        values: |
+          fullnameOverride: stirling-pdf
+          persistence:
+            enabled: true
+            size: 512Mi
+          deployment:
+            extraVolumeMounts:
+              - name: storage-volume
+                mountPath: /configs
+          probes:
+            liveness:
+              initialDelaySeconds: 90
+            readiness:
+              initialDelaySeconds: 60
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/stirling-pdf
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stirling-pdf
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/cert-manager.yaml

@@ -1,17 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cert-manager
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.whyredfire.tech/whyredfire/gitops
-    targetRevision: main
-    path: infra/cert-manager
-  destination:
-    server: https://kubernetes.default.svc
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

apps/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - nginx-app.yaml
-  - scriptscribe.yaml
-  - sealed-secrets.yaml
-  - cert-manager.yaml
-  - telegram-autoregexbot.yaml

bootstrap/argocd-cm-application-health-patch.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  resource.customizations.health.argoproj.io_Application: |
+    hs = {}
+    hs.status = "Progressing"
+    hs.message = ""
+    if obj.status ~= nil then
+      if obj.status.health ~= nil then
+        hs.status = obj.status.health.status
+        if obj.status.health.message ~= nil then
+          hs.message = obj.status.health.message
+        end
+      end
+    end
+    return hs

bootstrap/argocd-root-app/kustomization.yaml

@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
 resources:
   - namespace.yaml
   - root-app.yaml
-  - ssh-known-hosts-cm.yaml

bootstrap/argocd-root-app/root-app.yaml

@@ -6,9 +6,9 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://gitea.whyredfire.tech/whyredfire/gitops
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
-    path: apps
+    path: applications
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd

bootstrap/argocd-server-nodeport-patch.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: argocd-server
+spec:
+  type: NodePort
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 8080
+      nodePort: 30443

bootstrap/argocd/ssh-known-hosts-cm.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-ssh-known-hosts-c
-  namespace: argocd
-data:
-  known_hosts: |
-    # gitea-ssh.whyredfire.tech:22 SSH-2.0-OpenSSH_10.0
-    gitea-ssh.whyredfire.tech ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIANyEkbFQN5Yl8Vb6EAwzh2EveEj3yKXirFfXyuFqIV+
-    # gitea-ssh.whyredfire.tech:22 SSH-2.0-OpenSSH_10.0
-    gitea-ssh.whyredfire.tech ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCfixWweiVHuHDOOSzzqqsVjMMDXcl+dawNjezD7FOLraHapimb2j+omJ4evSWCNYG5usjmokgUntQ5wNTrsrWr7XlKOuBNjelleXBsjDba09IzfSRYA+pnbrcpgVjgQ647KJeULbD653oDL/cSEFV6r1NNWWlYVK139k0gsMw0JToMDp0LzNsTJytSFLvVg7st7fW/qoBI/RNq9qRC6okJJhldfpuraRVia1GhUiB79g4t9ylCvDlLXe+V3XdeMEEz8VY1bxVR5FHsRSuJqCPP1TbD9XnWWFZOBl6xjbcr2kDrnaAVocQJDkZLoKAZIR3lRaEjdFtz9v+Z4oAdIEVPNBWvE15bZdFHuCsB7eFpVuVzy7rDos9pGqXdK4h97oxU/edoRjMTDoDPHyl36154yiGAn4J55j1A8cWp97eyvTpRYYwr1Zab9M0AohJC8v69eprk4TZgL1TWGvchMDTHkd/RE2tEV1pv+cLe8bayV+BoE1Nx1plqIHTkSIu9e8=
-    # gitea-ssh.whyredfire.tech:22 SSH-2.0-OpenSSH_10.0
-    gitea-ssh.whyredfire.tech ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDLoFqTU09bU6ONUr9XvJT8G3zfwOviHw+ZM1EwPWVL5HEotYssWEjyteZGws5I0mXIuNJljL0BY1QSPoJaeAU8=
-    # gitea-ssh.whyredfire.tech:22 SSH-2.0-OpenSSH_10.0
-    # gitea-ssh.whyredfire.tech:22 SSH-2.0-OpenSSH_10.0
-

bootstrap/kustomization.yaml

@@ -1,8 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
 namespace: argocd
-
 resources:
-  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.0/manifests/install.yaml
-  - argocd
+  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
+  - argocd-root-app
+patches:
+  - target:
+      kind: Service
+      name: argocd-server
+    path: argocd-server-nodeport-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-application-health-patch.yaml

extras/add-ons/argocd-repos/repo-sealed-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-gitops-private
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgCYFWUZmqWTYbutOvQr0GJ87zvVwW/GYanXC4Qdlqo1nkYC0u/ve88UonB0UklJPfMq59/jefbrl80fg4JUMLJMBnNUiIfUIJ2gN07n5P1UqQGTFwo8iHFD4XwKlCfSD75wQXBhccWO1zS1lVZEIzbUdom7rI45bG2Q+u5NQBC/bs3NxrrzYqrHFsbE2jEeu0hG33JOoikvLOwih96Xxgadrvbdw/WpY2bbqM/BSA35u8fzeDF4ZZ98x7LPzflP04DxKJZLh5U3H1//RjWaKeNkDwp/dtNm63NPJrh7+rD+EOHu4undBwNHIW4vrv4bRQeP4xBERNFquiwwmQsi2Wwd4kpD+kgbGhezYMDgk8FOBwS04DJJJpvYdJdGTZoCwML1C+iwMoKhwk7WFvg4vkW3DBpRh+w9Otdq4odsklqgwp1o8OXL1hcd/iQqp8TiuwUFlmJhTs841xvqRMuCBQ0SnAwQ/u9kEsY6C6r/EvdaOciRoEWa0pMk3zvkaCrSkoAElYtXh30MhGfd1rbWT09Xvh/ACRjarBvLHUa7fPSc9Po9t+6eRuFR1cqT2jwUtHMuAqFA4XDC+oHkLsz8WD8qm4K9dwfOXME1rT2OoByaSdlSDsV6uKWRlMxxrzBGzihUBp1TSI8X+ux90hp5vQ30BKqGCC0Y3aRHprndDcHvdP4ASJ6++uu3ZkD6cY/he87w21ETl9+zxo8=
+    type: AgBWyIT44g9RaY/2dyznsXqQ3lVS0q/zJ5MeQhqkREsCn37U8ZxUrVqrmYq+RJU+cPVDWSl2tnmnfjvzV6+SEroVPAaTduRSFYxP6X4xsFuarJ21GSOAvt4Zc1ODZXYxCKfEAB+K7djc+g4+WOp/RihxKue9sevsM2krxnBXouNn7gXOog2Vd7mHbenuuGNVzV6ROJU7tw3uzZ/KETqr+5Jr1bKf64URkcN1njxb9lJHmK+VJbWPLcIbaGCfel07QqX0+EQXjIMwvpHoiWF25dJfPtbADlF/UIjWRXRRh5pCoppXpte39S4nrkkyOKCe2l7IctYF6+pvg5xNOmPeYnqIxpgZwWlWg2TcI5pn4aTxyXA+COJs5VQYgGDxPyNmm2lqh77hzHFceTxlFjtS5u5UQBzjagClXg2lYi2YRcnMTLUHDJyisT9Gr7bpgRK1BU19yxMg5f+vhzL5GmPMtOE6r9dZXwbi5660Okrn7x1MEgHb7poiXbG920yEC3mqVB6+1HLzoY5603b44VafDCTh2AtslSEW8n4Dt1gBm8DAOcDvq1e3NMn8Aq7cyGF5L7x0WwXLjgjr26nf6XiyZ9NAOD2upyJDCZvvVqcFypqOFsFOyhZXU86vuRW35tNqq6N3ppL2OFmm84ies04InHGTJHS3ps8KCyXWow1PgGhn/spB73JSjW4nsUztQPThOQ2c2JY=
+    url: AgDV+GO2ccs/uj87TNXbhSA18Y8amZiqmasZcijd/Zpjv8LPw94f9PORC1v9DhautblXF+Y39MnBjQm3pYLEbIU7FBDpx/Kkk34+F/tTfJqmQOcvGjEZLs73I7kvvy9Uy2Wme/uJt4PpR3UyJEAwJKNudC2NAJz2gfS7lsk+6AUpc+Z6MBoETdUQuaYlk/cxliWnPbJx8EYOS0TEaLezZ27w1OeN2kYEtnZ+qRd/+6g68MpM6UeoL53kOwNOcXN67+IdPE17zD05I0SPIKJy760Ukw/S1sphUpfQgOueHpmgpQanzJWZDCyudLpgnWS/cVWmZY0tDcgmiWCVJwYVFML8Qse3oXWRixIIunhMSS8jFk8Sa/v0agY8SOeIEWIx7n6G6jGkBLK5QZ8Y689UqsfsuKy3aUxno3gqzz4WibjdwAJfNsWCb3P6ZH2AfeTw7gz9HD/AiMRGuSTlzZpGS4acyltwbkKKz1WwLZF/qXtL0hi7QrYIPK82hKF7s458s0KQG2lE+bWOUG0WGjMWys6FwEbe5p3OTT2ea45+OyL0BlFQFkXHeIlxpq86Iz2KVxy4age5SghpSBn3+S3NM4voo9QDIeLXF++EOLCQXRXHgp4vOnb/nAVkbfQ6cvs2HBVg4lSYaNlBlznkPORiUNvXuu2JKHeKzXEJWhwIvmXrnac629MEaCCONEiBaTAy3B08WjSzvWUkxXYuBrRvrcm/JOP8K2yNgtJTRGGbH9SbMTJ8RoqgMC+GjokIFvlButxh0MeXlQLk0huV
+    username: AgBB0XO+j5xoMAgvbIKEf0/ghe9rPwoTnzZvm4lbakuCc4BEKl1Zm5bkNQilEBpxl/TsfnxdhhGnNvF9DXbIJjoEfEU8wzX5LpBMXt5qWC1Oquul4qvEHw6kMCu3oJ7hQ54yBVIhM5W9n1c6UWhJ6ttwZJ/ymqGLFWh1r/3KhoiInfU2EkPJ7bte085rUuyT524mwH9pfGEwte6VjuHPXBQt22i4fP+BBT3pV443PISshGfQC28bpt8vMi83kE/ICkwg21AQUImvfcHXojUJE5dks4mbrA49532R4uDVseVxCrW5fCtevQmgHbkyOke3FQG1AspXx7gdLldKVeW7QBgDP6O9DuEZgNzrxY6T4jf2dNUi1y5W00A4hJVMvIyBy4wENGIj1JJto6D1pRbYPzugKzUhb529UHS6Oxy3H2GqoE5L+mTbrQ2Nm8OhLeaSXUqQtJreZg9GYDZ3sjTe5tlqmcRisM43D5Aw/vV9wu40pRB0OTKM6nIHw1emg/Bq7ZAlZ9S8OpJYitO4SU9J1sOjnI1K3O1QLWB3buGoMnH/1k+Tt7rvYajWyqBM4ODV9O3yN1G9zEEXxzK7sz84JPGAevNJo7fiu8YdaMXhxVywhN43q6PpPQqTdqwQ0muJ5FqJbAzmOiDSQtF18OfpORrKJXVOwD/iFUS4V/6WKqn9HDAc1Dff1CgqJ8IOqxO43Jj4gpvkH2Owzdyf
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repository
+      name: repo-gitops-private
+      namespace: argocd

extras/add-ons/cert-manager/cluster-issuer.yaml

@@ -2,6 +2,8 @@ apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   acme:
     server: https://acme-v02.api.letsencrypt.org/directory
@@ -9,6 +11,8 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-prod
     solvers:
-      - http01:
-          ingress:
-            class: traefik
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token

extras/add-ons/traefik/wildcard-whyredfire-dev.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-whyredfire-dev
+  namespace: traefik
+spec:
+  secretName: wildcard-whyredfire-dev
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - "*.whyredfire.dev"

extras/services/jellyfin/httproute-local.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jellyfin-local
+  namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
+  hostnames:
+    - jellyfin-local.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: jellyfin
+          port: 8096

extras/services/jellyfin/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
+  hostnames:
+    - jellyfin.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: jellyfin
+          port: 8096

extras/services/seaweedfs/httproute-filer.yaml

@@ -0,0 +1,27 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: seaweedfs-filer
+  namespace: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  hostnames:
+    - seaweedfs.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: seaweedfs-all-in-one
+          port: 8888
+          weight: 1

extras/services/seaweedfs/httproute-master.yaml

@@ -0,0 +1,27 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: seaweedfs-master
+  namespace: seaweedfs
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  hostnames:
+    - seaweedfs-master.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: seaweedfs-all-in-one
+          port: 9333
+          weight: 1

extras/services/stirling-pdf/httproute.yaml

@@ -0,0 +1,24 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: stirling-pdf
+  namespace: stirling-pdf
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
+  hostnames:
+    - pdf.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: stirling-pdf
+          port: 8080
+

infra/cert-manager/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - https://github.com/cert-manager/cert-manager/releases/download/v1.19.2/cert-manager.yaml
-  - letsencrypt-issuer.yaml

infra/sealed-secrets/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.33.1/controller.yaml
-

manifests/nginx/deployment.yaml

@@ -1,21 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx
-  labels:
-    app: nginx
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: nginx
-  template:
-    metadata:
-      labels:
-        app: nginx
-    spec:
-      containers:
-      - name: nginx
-        image: nginx:1.29-alpine-slim
-        ports:
-        - containerPort: 80

manifests/nginx/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - deployment.yaml
-  - service.yaml

manifests/nginx/service.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: nginx
-spec:
-  selector:
-    app: nginx
-  ports:
-  - port: 80
-    targetPort: 80
-  type: ClusterIP