feat(argo): Expose argocd dashboard

.githooks/pre-commit

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Normalise staged manifests to their kubectl kustomize output, so what is
+# committed is exactly what Argo CD renders. Requires kubectl and yq.
+
+identity='[.apiVersion, .kind, .metadata.name // ""] | join("|")'
+
+git diff --cached --name-only --diff-filter=ACM -- '*.yaml' |
+  while IFS= read -r file; do
+    dir=$(dirname "$file")
+    name=$(basename "$file")
+    [ "$name" = kustomization.yaml ] && continue
+
+    # only normalise files the sibling kustomization lists as a resource, so
+    # patches and components are never replaced with build output
+    yq -r '.resources[]? // ""' "$dir/kustomization.yaml" 2>/dev/null |
+      grep -Fxq "$name" || continue
+
+    rendered=$(mktemp)
+    kubectl kustomize "$dir" |
+      yq eval-all "select(($identity) == \"$(yq eval-all "$identity" "$file" | head -1)\")" - >"$rendered"
+
+    if [ -s "$rendered" ] && ! diff -q "$file" "$rendered" >/dev/null; then
+      cat "$rendered" >"$file"
+      git add "$file"
+      echo "normalised $file"
+    fi
+    rm -f "$rendered"
+
+    # normalising may have reverted the change entirely
+    if git diff --cached --quiet -- "$file"; then
+      git reset -q HEAD -- "$file"
+    fi
+  done
+
+# nothing left staged — prevent an empty commit
+if git diff --cached --quiet; then
+  echo "pre-commit: no meaningful changes, aborting commit"
+  exit 1
+fi

applications/add-ons/cnpg.yaml

@@ -1,40 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cnpg
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  project: default
-  sources:
-    - repoURL: https://cloudnative-pg.github.io/charts
-      chart: cloudnative-pg
-      targetRevision: 0.28.2
-      helm:
-        values: |
-          replicaCount: 1
-          config:
-            clusterWide: true
-    - repoURL: https://cloudnative-pg.github.io/charts
-      chart: cluster
-      targetRevision: 0.6.1
-      helm:
-        values: |
-          cluster:
-            instances: 1
-            enablePDB: false
-            storage:
-              size: 500Mi
-          backups:
-            enabled: false
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

applications/kustomization.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  # add-ons
-  - add-ons/traefik.yaml
-  - add-ons/cert-manager.yaml
-  - add-ons/sealed-secrets.yaml
-  - add-ons/cnpg.yaml
-  # services
-  - services/app-argocd-repos.yaml
-  - services/app-autoregexbot.yaml
-  - services/app-betterslcm.yaml
-  - services/app-jellyfin.yaml
-  - services/app-legislative-summarization.yaml
-  - services/app-scriptscribe.yaml
-  - services/app-seaweedfs.yaml
-  - services/app-qbit.yaml
-  - services/app-stirling-pdf.yaml

applications/services/app-seaweedfs.yaml

@@ -1,36 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: seaweedfs
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  namespace: argocd
-spec:
-  project: default
-  sources:
-    - repoURL: https://seaweedfs.github.io/seaweedfs/helm
-      chart: seaweedfs
-      targetRevision: 4.33.0
-      helm:
-        values: |
-          allInOne:
-            enabled: true
-          master:
-            enabled: false
-          volume:
-            enabled: false
-          filer:
-            enabled: false
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-      path: extras/services/seaweedfs
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: seaweedfs
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

apps/garage-ui/anubis-key-sealedsecret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: anubis-key
+  namespace: garage
+spec:
+  encryptedData:
+    ED25519_PRIVATE_KEY_HEX: AgCviDZEvLfdKldhAtWubXmCxvCym6nEFBERMBDbfMftsCQdRdWFwAZ3IkQF5PqyBCjZ8jirQMttmXqL1GNKvJfEDkK4rwwYGkLpRM56IpRtkGhGHgYQOIYTa9RHzJm5OjPKnVppCRpb4Qe2MKczg8Uhp7Z3hW1HMDzK85Rzn2k41qcGqMRwEgDdmFVJxB9gviM76jcrgjnyNJvoIMinNwqRdTHmXnY451xDkBofEzkTXZC7plW42/3Vz/66bdqtHCmM68hZJkluki86ubHJqPIMuA55BJM7CRJTgKhk5va4Ex3j4RlTSF7ai+EGmF+jq6ls8Dn1QU12Osak97MulOEyCBHBQg3nnu5TZoFJKWT/Bgg0M9r1RuFyr6mrphVu6yMIIiROcyl95E3LjtMVC4o7+tWgkYmIOjYafQdpf7p6I2QPG4P6o/6qkEUWL1tqqYjk9RZ+OuOuBWe399in4OnRgfV+ZOJcCKXIsgbW1uVAiQL3lGMGI9/sDLxKtimpybGOX5F9f3O7mqFZ7FzkdvhgUtWkY+PUJIZHFNUSlF+ttmrj3wtq4JOpFdPYZqcnTCFFtwk+yDos8YWWjF0TX1RhM8Yq/+VBOVVaJnlhaolIKHiMds5JBGypsPjEBmP9fJ1ip4TjCyCP3p1/YscksgqjUWOCeASO9b50ce0OJzL9yHMGurffianLWR768q/1Zi5WQv6B9vJxCICa9TCCYgLOz0LUu0iiMd5hlPX0/i4gWi9KykIcSYHJ/RuE9+4jaqkYsTyhOipKPpkpjsqou9y1
+  template:
+    metadata:
+      name: anubis-key
+      namespace: garage

apps/garage-ui/anubis-proxy.yaml

@@ -0,0 +1,44 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis
+  namespace: garage
+spec:
+  anubis:
+    envExtra:
+      - name: DIFFICULTY
+        value: "5"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: COOKIE_DOMAIN
+        value: garage.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: garage.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  target:
+    service:
+      name: garage-ui
+      port: 80

apps/garage-ui/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: garage-ui
+  namespace: garage
+spec:
+  hostnames:
+    - garage.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: anubis
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/garage-ui/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - anubis-key-sealedsecret.yaml
+  - anubis-proxy.yaml
+  - httproute.yaml

apps/garage-ui/sealed-secret.yaml

@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: garage-ui-secrets
+  namespace: garage
+spec:
+  encryptedData:
+    admin-password: AgCQeGAvd1QdDC8IUwNYqHJxRES1jfPbonYTyutCklms6tjebQw1pRKnbDWGRaFmgWg5jFRPYf6TAMRnZnA/1dKJMOrV9vGjqx++r+khWbe5oqvcoQInqVdbkfulHoP/Bf6jc2mj9znGqpW6E7e6Z94pwwYkpaY2CIYhfcs7PiaTh7HiFMmoNWlGmHBh+lIZ//WJblgpFdQRWR9j7CiIJOLC3OmAvGV+Uh5i15fdA9aTBLZaB1pWh/kqug/mmj6q5E3Bp7BlC7Pm20Dbyn85kfA9RjAM/AkWSycGcBgk+FaJKFVJnPzrHcx6CdkbUnczxGVrbs+C89pzCk8ysaOVSNDErW0rCWNaHrflRx6P1+OUamCWWafZdkWTGQ4m0I5pX5IQ40zIK1uE8Zzil8EJPynfs37fNzn54wVBmsaKpsFC/3y+d8UTVgf1shJF0cqPimWjCZPqvUZrimL/20tPhTSERaxtWSq14l39bQUc4sNZdaKc69IkI04geI9OPvE+XXQNYe86XPYlNJ/R5curg1RvQxAR59sb04RmZAfdSvcwYxpK1Ekchq/e9IK4ft6Ul70nE/oN43NE2Ck1+5/EOjucFmIQzZ49Jq2OIjHuBjA/p/BmwAhiZVwPObRJ0VoL9XDv7BVB+S/+RWnFjDW7J5YhWquZ2Y6XwspHhpjvHmH+LLSio/34VpWQgG/lSAhvSPuRkIp/XxhQwemti+3yQNeqfXtvpfKa1IgAg9ic/rbocQIUtQDaT4yYFi7cruTpx7U=
+    admin-token: AgDBYTHO2ZgJig+h3wIv1ru7VxEDKIq+SUjOygg39lVaF1bH0ADaWOdr1m6nP37LiBCyQSGtqilUGqXPV91VRiJJqFBXLTnYs0JbmXGekkfeImztAd7LL3yqKHThji/Bo+vD00PC3SAbpder2d6BJhOMez2XqFY2vPSY81earoiR+ajzuvHBC4PuwDjNYwnNq5BkGCF/D6EOenVfVJZdWHG4/oCciJzX+fwYQYw0sY8ur5cRxyY6wyWC2QH9YflDKbwFteiqnh8E1+B4mqSFiTcaM79FAU6rYxknXmw/BArNdbXvAxvYDyGKxQA1k6GwW9TWSg/CpKAmuJW2Xv1nMCqt3ZIJCTO/H1PIi24XouNBGc9n0VOWKNWZTI8CIZLRB+/LzLuT/vjhu4qA/LE6SkDXw1dTkgkkUChUKN4PrWfwTVIEgZwjPdewOZ9D9JT8TmPSZtGvVuDVOJl7+wBYGT4SkI9W2qU91h1VT+vmXO/7QyQ/kj2ny092GjT2aJTFAbtusAjV3dKZnfodXaCX/dQ3JnSuP2mWQGZ/2Gj5AB92FNvqeTkiqovS2hGgXjyOYp4JeXVPvBa1tWEo0Cy4FrqBLaycNIHuhGiWAhLrivXTX2YqyM3NfEmEuyzXu5M3E6eQhaF8uveDjqhxF1z07IUXU8zBCvHtC7vX2aYPfSKGWcpvGKa8NnkjamRY1qJbj1Jr15a9UBSM1TyWNGp3pxFHyy707FlayRDIdJOe0iYqQw/5qZQJBl1u4/1zbOldP3dPFtbGuhR257+wNWwKKfACorTsBg==
+    jwt-key.pem: AgBYRkRh01LSyyozE46odjgrHsZ6gI3ykVOdV7qMPEFt5lILq44BKFt3vVL+yAUz0brVPQeEjz7dg+xsurAKKMjvuxzkOqBsSFhWwBzy+f+GfTSZPBrBNPAX7jI05dUNbcu2UuxYMlgVq6VWa9lf0Gc8yvuEuD0nS2qmpj1ACL6awLBKnkVXL9c5mvoC97DRyk920rPTnERJGU5q7i+zue4sxufYJwJZAJLOmdpzavHfQ3lCcJr6FfboFmGnvD6SM85rXTtImyDY4tsXf4J1rRriYR1OQe91j4SSbvxDFskXYSQ4bTgjimat21SXLCImj/Pqh6LJz7wMd9aW95ju4jDE1q1og0ToIL0Nybl9ANhqlJgFtOfvQRnaJVQQw/2GitlDVejJHCYWsVsSxQtAhvrGdWDOrZ1eTzvsmBnGcWzDwtC1YN3u+Wd0qJBfoRIJLiinwLaJ7ponm5MSb9Qjkym99gXm6XUO0MlHS52pfVaai+OmyWE6B6nF9tf3YVXfjZcNVB1pFHCZZR6XcnIm+wi1EwxXR8NIeFgqiaIm+BwX9u6IMiQOHCVznHD5nc2wfSXpeeT75IX/HAzRWC2cc6a8vPsr+h4A4hqW+cOoMYb9gQQIa+F5X4LcWb6f/0HJHh1IO4vf+P2hVU/5CkpgGJk+x48KgkrX0CE+bafQQjNp8JTdis1gxSGEX0QUaVGl+x7exGhrKlW81ZZTovequibx1JhdNSXNbWZxQ2fXz7SdN+/AjYyEh1gNPI2Zx6RRJc5BlDSSt7TYwqy1NUcPfbJV7hbqV7oDUH8JrsoSk+xxB0WDE+Uh5P4MsQna6NWkWyFV4tvfK4QyMupQaxOAKOYV27DxBaTr
+  template:
+    metadata:
+      name: garage-ui-secrets
+      namespace: garage

apps/garage/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - service-admin.yaml

apps/garage/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: garage-secrets
+  namespace: garage
+spec:
+  encryptedData:
+    rpcSecret: AgDWvOoSUADQx+cExTUDmk6/BWR8a7U5HRGf+T38P24FrP4DJiKl3GJ3Ce9a3eF7SqO/1TXiaN80+c4NX0dMEmnaS8III2Zbaa7x/rOHP608Vh1z2Nnxly11X10okVy+Qym9O5/oA3cue2bu6K3eG8W38mn3hCA9kWC6g9OiAwjBTxJXYmsUFYbj69Iloo9moBBLEtztu8T9vYu8rGqcchKzzjnvcS91kiduq9rY9/ZvYC4zx469DgnV/di8cjGdU6JAtsoHwggDtCVf2hvkyOIHTyPM9Y/EVGCsOsIzhJnTdsyRGn4su3ruLmS8VqbKC22Q86pSHjwdlD5RoZJjYtMWr5Q5YAvFbnTH9/+d0r363BfxlNsVkINd5d2OwlPpagEQ9pg4oFnnk48tsVEoYz1RCy9x/bK3U4B0Jin6l0T2NJ3umXPriLxBQbODWVA9vcv6G1tQiiuOsbYCWigoxe3ACpuYQDV+XujfmEZr3pcIw0hwKXtUWHI079aUkICcMEbtE3gLc1dNVQpja1SimZOUlqf6pz3YLv6L1e2X+yR93p2rN6hc8IJh3KA8ZR1Ymbbq2LaOwdyla50uuhsOkE2TGDTGmf9NyXjGcUys5LgNpRruzXEm/KgUX4tP7iMjHu5HbnDe9oiv66qfuIORiR2P3lbOdx3s+XmPd/87afw6YHA896ccCRkGpGnFanbrR+Z7MRqCOZsSLnQd1JpjnWJJU/bzrSl4q+PUV1Bt+hvAf8wXUrDtES6MdpOKUe4XW8s3QbVHvCx1iOSzP+r59T4N
+  template:
+    metadata:
+      name: garage-secrets
+      namespace: garage

apps/garage/service-admin.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-admin
+  namespace: garage
+spec:
+  ports:
+    - name: admin
+      port: 3903
+      targetPort: admin
+  selector:
+    app.kubernetes.io/instance: garage
+    app.kubernetes.io/name: garage

apps/jellyfin/httproute-local.yaml

@@ -1,23 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: jellyfin-local
-  namespace: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: jellyfin-local
+  namespace: jellyfin
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - jellyfin-local.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: jellyfin
+          port: 8096
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: jellyfin
-          port: 8096

apps/jellyfin/httproute.yaml

@@ -1,23 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: jellyfin
-  namespace: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: jellyfin
+  namespace: jellyfin
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - jellyfin.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: jellyfin
+          port: 8096
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: jellyfin
-          port: 8096

apps/jellyfin/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - httproute-local.yaml
+  - httproute.yaml

apps/stirling-pdf/anubis-key-sealedsecret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: anubis-key
+  namespace: stirling-pdf
+spec:
+  encryptedData:
+    ED25519_PRIVATE_KEY_HEX: AgA81eNBpnSj7I5hSRoZxhU+d3+7u8xM93SzO0eNbMJ448rgvDG+MHzmmLgIxXlE2Sf7OS98+Xwi29eePt9+EiMrhWV5tqgy+gKAFYq1SEEe9tkMn5Ie/rdBgAfdwgnerg2kjLLeRnqeJOaqrHXXcMuxUFM7nc0DwqHe5dLPqVysJGQy4dGzBo+QxvYJuQ7TPtDXEGdE41AchPcR/2UfV7dGH8pqldqlFSJlb0M4rj/2XvinHWEKzPb8mXOHQ+aaENgm4NHTMJ6wjFX1VrO+MAQ7Ktm4ttcF4U/7PMwpMjBF+MaPmdGhFxnENOTvLhV/qcHw3qEDzsEFCosbMAJ4UxqXi0DwdqHYdfsp6bus0xL7RLrQxQw0SQmSYL0Cy+S78/3uk4EhBthvfi/VcJw536WvxZZrzhVp1ItRn9nUWI/oh1iNHAlyXQbMkmWIGIDC8iXtvE0DVWa8Ui16X14dPAZg7z1BAbjPZ+oi1MjcO4kuqVoDknkrBJxMEMYTxtQ8nbqDsKbTA9kNLo0JCmHOiP9l3/4f6hVw/B8uB5O6O2Vionz5U0AsnrunLMNvfeYleaS9290m+msg6T/umr7BgrVNXUEkG3GfJZ3xt8urHNjwXb/ESG5T5JnPYIRdTcITLuzLSKul5lBL+4PT3zOdjt9G/XD6HootT+AN9DuvfebM08RtMIK1mpI3Gx2owcKHxICIdgV/oaIGpe1q0L21jDp5sd30wm/3rfr6eKq1zuDiObA6N6EHI/7224Xw0sUuN2GmnRJ6RA5BQSXwSdeGqdG3
+  template:
+    metadata:
+      name: anubis-key
+      namespace: stirling-pdf

apps/stirling-pdf/anubis-proxy.yaml

@@ -0,0 +1,52 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis
+  namespace: stirling-pdf
+spec:
+  anubis:
+    envExtra:
+      - name: DIFFICULTY
+        value: "4"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: OG_PASSTHROUGH
+        value: "true"
+      - name: OG_EXPIRY_TIME
+        value: 24h
+      - name: COOKIE_DOMAIN
+        value: pdf.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: pdf.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+      - name: SLOG_LEVEL
+        value: INFO
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  networkPolicy:
+    enabled: true
+  target:
+    service:
+      name: stirling-pdf
+      port: 8080

apps/stirling-pdf/httproute.yaml

@@ -1,24 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
   name: stirling-pdf
   namespace: stirling-pdf
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - pdf.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: anubis
+          port: 80
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: stirling-pdf
-          port: 8080
-

apps/stirling-pdf/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - anubis-key-sealedsecret.yaml
+  - anubis-proxy.yaml
+  - httproute.yaml

argocd-apps/add-ons/anubis-operator.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis-operator
+  namespace: argocd
+spec:
+  destination:
+    namespace: anubis-operator-system
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    kustomize:
+      images:
+        - public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
+    path: config/default
+    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
+    targetRevision: v0.4.4
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/add-ons/argocd-dashboard.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: argocd-dashboard
+  namespace: argocd
+spec:
+  destination:
+    namespace: argocd
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: infra/argocd-dashboard
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd-apps/add-ons/argocd-repos.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: argocd-repos
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: argocd-repos
+  namespace: argocd
 spec:
+  destination:
+    namespace: argocd
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: infra/argocd-repos
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
-    path: extras/add-ons/argocd-repos
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/cert-manager.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cert-manager
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: cert-manager
+  namespace: argocd
 spec:
+  destination:
+    namespace: cert-manager
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://charts.jetstack.io
+    - chart: cert-manager
-      chart: cert-manager
-      targetRevision: v1.19.3
       helm:
         values: |
           crds:
@@ -20,12 +21,11 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://charts.jetstack.io
+      targetRevision: v1.21.1
+    - path: infra/cert-manager
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: extras/add-ons/cert-manager
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: cert-manager
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/cnpg.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: cnpg
+  namespace: argocd
+spec:
+  destination:
+    namespace: cnpg-system
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    chart: cloudnative-pg
+    helm:
+      values: |
+        replicaCount: 1
+        config:
+          clusterWide: true
+    repoURL: https://cloudnative-pg.github.io/charts
+    targetRevision: 0.29.0
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/add-ons/gateway-api.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: gateway-api
+  namespace: argocd
+spec:
+  destination:
+    namespace: default
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: config/crd
+    repoURL: https://github.com/kubernetes-sigs/gateway-api.git
+    targetRevision: v1.6.1
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true

argocd-apps/add-ons/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - anubis-operator.yaml
+  - argocd-dashboard.yaml
+  - argocd-repos.yaml
+  - cert-manager.yaml
+  - cnpg.yaml
+  - gateway-api.yaml
+  - sealed-secrets.yaml
+  - traefik.yaml

argocd-apps/add-ons/sealed-secrets.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: sealed-secrets
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "0"
+  name: sealed-secrets
+  namespace: argocd
 spec:
+  destination:
+    namespace: sealed-secrets
+    server: https://kubernetes.default.svc
   project: default
   source:
-    repoURL: https://bitnami-labs.github.io/sealed-secrets
     chart: sealed-secrets
-    targetRevision: 2.18.5
+    repoURL: https://bitnami.github.io/sealed-secrets
-  destination:
+    targetRevision: 2.19.1
-    server: https://kubernetes.default.svc
-    namespace: sealed-secrets
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/traefik.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: traefik
-  namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+  name: traefik
+  namespace: argocd
 spec:
+  destination:
+    namespace: traefik
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://traefik.github.io/charts
+    - chart: traefik
-      chart: traefik
-      targetRevision: v39.0.2
       helm:
         values: |
           providers:
@@ -19,9 +20,10 @@ spec:
             kubernetesIngress:
               enabled: false
           service:
-            type: ClusterIP
+            spec:
-            externalIPs:
+              type: ClusterIP
-              - 192.168.2.5
+              externalIPs:
+                - 192.168.2.5
           gateway:
             listeners:
               web:
@@ -38,12 +40,11 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dev
                     group: ""
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://traefik.github.io/charts
+      targetRevision: 41.2.0
+    - path: infra/traefik
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: extras/add-ons/traefik
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: traefik
   syncPolicy:
     automated:
       prune: true

argocd-apps/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - add-ons
+  - services

argocd-apps/services/autoregexbot.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: telegram-autoregexbot
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: telegram-autoregexbot
   namespace: argocd
 spec:
+  destination:
+    namespace: telegram-bot
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/santarl/telegram-autoregexbot
     targetRevision: main
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: telegram-bot
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/betterslcm.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: betterslcm
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: betterslcm
   namespace: argocd
 spec:
+  destination:
+    namespace: betterslcm
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/DK10WS/SLCM_APP.git
     targetRevision: web
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: betterslcm
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/garage-ui.yaml

@@ -0,0 +1,46 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+  name: garage-ui
+  namespace: argocd
+spec:
+  destination:
+    namespace: garage
+    server: https://kubernetes.default.svc
+  project: default
+  sources:
+    - chart: garage-ui
+      repoURL: https://helm.noste.dev/
+      targetRevision: 0.12.1
+      helm:
+        values: |
+          config:
+            server:
+              domain: garage.whyredfire.dev
+              protocol: https
+              root_url: https://garage.whyredfire.dev
+            garage:
+              admin_endpoint: http://garage-admin:3903
+              existingSecret:
+                name: garage-ui-secrets
+            auth:
+              admin:
+                enabled: true
+                existingSecret:
+                  name: garage-ui-secrets
+              jwt_private_key_secret:
+                name: garage-ui-secrets
+            cors:
+              enabled: false
+    - path: apps/garage-ui
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/services/garage.yaml

@@ -0,0 +1,84 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: garage
+  namespace: argocd
+spec:
+  destination:
+    namespace: garage
+    server: https://kubernetes.default.svc
+  project: default
+  sources:
+    - repoURL: https://git.deuxfleurs.fr/Deuxfleurs/garage.git
+      targetRevision: v2.4.1
+      path: script/helm/garage
+      helm:
+        values: |
+          garage:
+            singleNode: true
+            existingRpcSecret: garage-secrets
+            noClusterRole: true
+            # No discovery or website listener is needed for standalone S3.
+            garageTomlString: |
+              metadata_dir = "/mnt/meta"
+              data_dir = "/mnt/data"
+              db_engine = "sqlite"
+              metadata_fsync = true
+              data_fsync = true
+              replication_factor = 1
+              rpc_bind_addr = "127.0.0.1:3901"
+              rpc_public_addr = "127.0.0.1:3901"
+              rpc_secret = "__RPC_SECRET_REPLACE__"
+
+              [s3_api]
+              s3_region = "garage"
+              api_bind_addr = "0.0.0.0:3900"
+
+              [admin]
+              api_bind_addr = "0.0.0.0:3903"
+              metrics_require_token = true
+          image:
+            repository: dxflrs/garage
+          initImage:
+            tag: "1.37.0"
+          persistence:
+            meta:
+              storageClass: local-path
+              size: 1Gi
+            data:
+              storageClass: local-path
+              size: 9Gi
+          podSecurityContext:
+            seccompProfile:
+              type: RuntimeDefault
+          securityContext:
+            allowPrivilegeEscalation: false
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: admin
+            timeoutSeconds: 3
+          livenessProbe:
+            tcpSocket:
+              port: s3-api
+            initialDelaySeconds: 60
+            periodSeconds: 20
+            timeoutSeconds: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+    - path: apps/garage
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/services/jellyfin.yaml

@@ -1,18 +1,21 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: jellyfin
   namespace: argocd
 spec:
+  destination:
+    namespace: jellyfin
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://jellyfin.github.io/jellyfin-helm
+    - chart: jellyfin
-      chart: jellyfin
-      targetRevision: "2.7.0"
       helm:
         values: |
+          image:
+            tag: "12.0"
           service:
             type: ClusterIP
             port: 8096
@@ -26,12 +29,11 @@ spec:
               enabled: true
               type: hostPath
               hostPath: /srv/media
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://jellyfin.github.io/jellyfin-helm
+      targetRevision: 3.2.0
+    - path: apps/jellyfin
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: extras/services/jellyfin
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: jellyfin
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - autoregexbot.yaml
+  - betterslcm.yaml
+  - garage.yaml
+  - garage-ui.yaml
+  - jellyfin.yaml
+  - legislative-summarization.yaml
+  - qbit.yaml
+  - scriptscribe.yaml
+  - stirling-pdf.yaml

argocd-apps/services/legislative-summarization.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: legislative-summarization
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: legislative-summarization
   namespace: argocd
 spec:
+  destination:
+    namespace: legislative-summarization
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/whyredfire/legislative-summarization
     targetRevision: main
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: legislative-summarization
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/qbit.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: qbit
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: qbit
   namespace: argocd
 spec:
+  destination:
+    namespace: qbit
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: qbit
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
     targetRevision: main
-    path: qbit
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: qbit
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/scriptscribe.yaml

@@ -1,19 +1,19 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: scriptscribe
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: scriptscribe
   namespace: argocd
 spec:
+  destination:
+    namespace: scriptscribe
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: k8s
     repoURL: https://github.com/whyredfire/scriptscribe
     targetRevision: main
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: scriptscribe
   syncPolicy:
     automated:
       prune: true

argocd-apps/services/stirling-pdf.yaml

@@ -1,16 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: stirling-pdf
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  name: stirling-pdf
   namespace: argocd
 spec:
+  destination:
+    namespace: stirling-pdf
+    server: https://kubernetes.default.svc
   project: default
   sources:
-    - repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
+    - chart: stirling-pdf-chart
-      chart: stirling-pdf-chart
-      targetRevision: "3.1.0"
       helm:
         values: |
           fullnameOverride: stirling-pdf
@@ -26,12 +27,11 @@ spec:
               initialDelaySeconds: 90
             readiness:
               initialDelaySeconds: 60
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
+      targetRevision: 3.1.0
+    - path: apps/stirling-pdf
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
-      path: extras/services/stirling-pdf
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: stirling-pdf
   syncPolicy:
     automated:
       prune: true

bootstrap/argocd-cm-url-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  url: https://argo.whyredfire.dev

bootstrap/argocd-cmd-params-cm-server-insecure-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  server.insecure: "true"

bootstrap/argocd-cmd-params-cm-server-side-diff-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  controller.diff.server.side: "true"

bootstrap/argocd-root-app/root-app.yaml

@@ -4,14 +4,14 @@ metadata:
   name: root-app
   namespace: argocd
 spec:
+  destination:
+    namespace: argocd
+    server: https://kubernetes.default.svc
   project: default
   source:
+    path: argocd-apps
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
-    path: applications
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
   syncPolicy:
     automated:
       prune: true

bootstrap/argocd-server-clusterip-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: argocd-server
+spec:
+  type: ClusterIP

bootstrap/argocd-server-nodeport-patch.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: argocd-server
-spec:
-  type: NodePort
-  ports:
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 8080
-      nodePort: 30443

bootstrap/kustomization.yaml

@@ -2,14 +2,26 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: argocd
 resources:
-  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml
   - argocd-root-app
 patches:
   - target:
       kind: Service
       name: argocd-server
-    path: argocd-server-nodeport-patch.yaml
+    path: argocd-server-clusterip-patch.yaml
   - target:
       kind: ConfigMap
       name: argocd-cm
     path: argocd-cm-application-health-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-url-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cmd-params-cm
+    path: argocd-cmd-params-cm-server-side-diff-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cmd-params-cm
+    path: argocd-cmd-params-cm-server-insecure-patch.yaml

extras/services/seaweedfs/httproute-filer.yaml

@@ -1,27 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: seaweedfs-filer
-  namespace: seaweedfs
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  hostnames:
-    - seaweedfs.whyredfire.dev
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - group: ""
-          kind: Service
-          name: seaweedfs-all-in-one
-          port: 8888
-          weight: 1

extras/services/seaweedfs/httproute-master.yaml

@@ -1,27 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: seaweedfs-master
-  namespace: seaweedfs
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  hostnames:
-    - seaweedfs-master.whyredfire.dev
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - group: ""
-          kind: Service
-          name: seaweedfs-all-in-one
-          port: 9333
-          weight: 1

infra/argocd-dashboard/anubis-key-sealedsecret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: anubis-key
+  namespace: argocd
+spec:
+  encryptedData:
+    ED25519_PRIVATE_KEY_HEX: AgCR+UcOTNv+hAcK3jE3fb0AE5lQBuxl0Y7Yqt3Lg/Bhh89aPH2dRs0o2n/1MuCXNGOtBAXdyKtW6W3VtenD1uKsoz8da2UjO3+qvknLmrZzUqjcilmiJCS7POoECHhciCMJu1RrLkSQChjg+Kl6fZUbDSTK5GTh75yy7o1uRtXqbgXFtdVDYA8fwXLoAG4nWlSgRgGTUnTKTKooyx+ADEJOQWrFCP0zFkZJKUcGc60d6+5PyYGODDNjh1qed30O7xWyZcCVVUzeSkH5QCpBvALRzKLGBRjNTHAS4IGVelemPqsN5ti4w6fYGtkqi4OPuAuaC47kdEnLUvZeDB+Qxnwx6Qe7MEI4u8H2N6mP8jMH9MjQv4gzCTtPy90Vqikf7hJ0KFsI5CGXONbQkkyM1B3MNbyqkgmtZJchVbmeN9MZhZOS7JYUuexYosdiqRvyIOAWr1/rSN9LzwesXNAPojq8IZPDjIPcbFCBv1ROjsS/kXKawlLBMX+XEsQZUWUfTh9Cfn3N9muo4Sz+nQ11smXthSkVRaniJLIsd+MPXg/lHayP6MYWncPhj8ZZQHKwBNxsCHljh1cFsjfm/IrIDmre6eaREnsBrxh7QKtsoiWWclqgF4ziA4BVWHwkfpb1LjIQNDIkD+i66ijOmwpQoiCD8tWRKrvcGWy6bTDPMO0ErA5QVzDx8YMFmSC5Ii0iSWIR2ci+qlKgUHFedVnp2kOw4FyOxWsDnfJDBmwyPvXrfrbDcvSfKMTLn6VohWC4Zais5bIuhD0uAmCdfJzyRe+H
+  template:
+    metadata:
+      name: anubis-key
+      namespace: argocd

infra/argocd-dashboard/anubis-proxy.yaml

@@ -0,0 +1,44 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis
+  namespace: argocd
+spec:
+  anubis:
+    envExtra:
+      - name: DIFFICULTY
+        value: "5"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: COOKIE_DOMAIN
+        value: argo.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: argo.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  target:
+    service:
+      name: argocd-server
+      port: 80

infra/argocd-dashboard/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: argocd-dashboard
+  namespace: argocd
+spec:
+  hostnames:
+    - argo.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: anubis
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

infra/argocd-dashboard/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - anubis-key-sealedsecret.yaml
+  - anubis-proxy.yaml
+  - httproute.yaml

infra/argocd-repos/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - repo-sealed-secret.yaml

infra/cert-manager/cloudflare-api-token-sealed-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgAWGbxZBGrznQxIKfKmKEqAwNKY025ojuhr1l2vgoj/dBJ3vxpKX2tYAxZse5gu+G5CiI+130atGPCqJxGB0oRTbeTi9Zyxhw+FclxGMcXrfqZtXVUANrNUmpVZMgMF5pzd04rY9WdvK9tQiXnDp4SayzpRpzoHgln5gvTeLaArOQ3NC/2Nx/Ka+ImFUvxPvCI8H3ANXuRlk3dFfnLN8Uwj3NXWmsmTphq4hDzHXc0IWoV26MFwoKftjfVlirlKbP4LBCp65mXdluu3/EsuA0P2AS2S0RkFAucBPCPe2z24bivMZgn61KBGIJJ/waJITQ5CfYMPWwzDhNuabdosNKW0HejIy5cYZxMOBTz1t8xGYhOBsNB3t3KbyOqE9qxDxdZqiPQbvM3zyagRPaucHt15tjUqEzHymi0GGFToixRcnlQAdVrxmcb6JRe7eVrful/PNB3rG29DEuiCbXDOfMPbScjDkxNpKgQTAXnhRaPrjR49dpW0pkNABn11DcU4RsckelfD5cdxt+E0Oe/P8nKcglrgHMFZLSV30JGT+WEv2xx1M7VFz7NdxyrB0K8f8/hf3f5lEEHqTzPfaWQUIL7ZBIOqbtqvlnlx0m70QOzkeMUQdTO5jo1MoZy7MgomOCGPAaXUhDrDtxYCgipmMIbjCo6RokS86YlvqE9BNTpxt1LXX6p0rLKTiN0JeumLTU0rmdvMBxP1dH0LyTd9GWrNvbX8ve6ikbPTo7xAPG9KwlO5M4pY9MJP
+  template:
+    metadata:
+      name: cloudflare-api-token
+      namespace: cert-manager
+    type: Opaque

infra/cert-manager/cluster-issuer.yaml

@@ -1,18 +1,18 @@
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: letsencrypt-prod
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: letsencrypt-prod
 spec:
   acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
     email: [email protected]
     privateKeySecretRef:
       name: letsencrypt-prod
+    server: https://acme-v02.api.letsencrypt.org/directory
     solvers:
       - dns01:
           cloudflare:
             apiTokenSecretRef:
-              name: cloudflare-api-token
               key: api-token
+              name: cloudflare-api-token

infra/cert-manager/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cloudflare-api-token-sealed-secret.yaml
+  - cluster-issuer.yaml

infra/traefik/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - wildcard-whyredfire-dev.yaml

infra/traefik/wildcard-whyredfire-dev.yaml

@@ -4,11 +4,11 @@ metadata:
   name: wildcard-whyredfire-dev
   namespace: traefik
 spec:
-  secretName: wildcard-whyredfire-dev
+  dnsNames:
+    - '*.whyredfire.dev'
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
   privateKey:
     rotationPolicy: Always
-  issuerRef:
+  secretName: wildcard-whyredfire-dev
-    name: letsencrypt-prod
-    kind: ClusterIssuer
-  dnsNames:
-    - "*.whyredfire.dev"