Some checks failed
validate / lint (push) Failing after 1s
bitnami-labs.github.io/sealed-secrets returns 404 -- Bitnami migrated the sealed-secrets Helm repo to the main bitnami org on 2026-06-15 (bitnami/sealed-secrets#1982), and GitHub Pages doesn't redirect the old Pages URL. Pre-existing external breakage (last successful Argo CD sync was 2026-05-16, before the migration), not something introduced this session -- the sealed-secrets-controller pod itself kept running fine throughout, this only blocked Argo CD's ability to diff/compare state. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Argo CD
Argo CD is the cluster reconciler for this repo. manifests/argocd/app-of-apps.yaml
points Argo CD at argocd/apps, where each file defines one child
Application.
Bootstrap
Install or upgrade Argo CD with the pinned chart values:
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm upgrade --install argocd argo/argo-cd \
--namespace argocd --create-namespace \
--version 9.4.15 \
--values argocd/values/argocd.yaml
Then apply the app-of-apps:
kubectl apply -f manifests/argocd/app-of-apps.yaml
Argo CD is exposed at https://argocd.home.arpa by
manifests/argocd/argocd.yaml.
Application Types
| Type | Examples | Source |
|---|---|---|
| Helm chart plus values | Traefik, cert-manager, Gitea, Pi-hole, monitoring, Loki, Tempo | argocd/apps/*.yaml and values/*.yaml |
| Raw manifest directory | Core, media, network secrets, home services, portfolio | manifests/* |
| Argo CD self-management | argocd-self, argocd-config |
argocd/values and manifests/argocd |
Most Applications use automated sync with selfHeal: true and prune: false.
Expect Argo CD to correct drift, but do not expect deleted Git resources to be
pruned automatically.
Adding a Service
- Add raw manifests under
manifests/<area>or Helm values undervalues/. - Add an
Applicationinargocd/apps/. - Add any required DNS entries to both Pi-hole values files.
- Add certificates, secrets, and registry pull secrets if the service needs them.
- Commit and let the app-of-apps reconcile.
Use targetRevision: main for repo-managed services unless there is a specific
reason to track HEAD.