Some checks failed
validate / lint (push) Failing after 1s
The placeholder targetRevision reached origin/main and broke the Application's comparison (ComparisonError: "improper constraint: REPLACE_ME"), showing as a broken card in the Argo CD UI. The actual Authentik pods were never affected (sync policy has no `automated` block, so nothing was ever applied against the live release) -- confirmed all authentik namespace pods stayed Running 1/1 throughout. Fixed using the real deployed chart version read off the live authentik-server pod's helm.sh/chart=authentik-2026.2.1 label, not a guess. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Argo CD
Argo CD is the cluster reconciler for this repo. manifests/argocd/app-of-apps.yaml
points Argo CD at argocd/apps, where each file defines one child
Application.
Bootstrap
Install or upgrade Argo CD with the pinned chart values:
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm upgrade --install argocd argo/argo-cd \
--namespace argocd --create-namespace \
--version 9.4.15 \
--values argocd/values/argocd.yaml
Then apply the app-of-apps:
kubectl apply -f manifests/argocd/app-of-apps.yaml
Argo CD is exposed at https://argocd.home.arpa by
manifests/argocd/argocd.yaml.
Application Types
| Type | Examples | Source |
|---|---|---|
| Helm chart plus values | Traefik, cert-manager, Gitea, Pi-hole, monitoring, Loki, Tempo | argocd/apps/*.yaml and values/*.yaml |
| Raw manifest directory | Core, media, network secrets, home services, portfolio | manifests/* |
| Argo CD self-management | argocd-self, argocd-config |
argocd/values and manifests/argocd |
Most Applications use automated sync with selfHeal: true and prune: false.
Expect Argo CD to correct drift, but do not expect deleted Git resources to be
pruned automatically.
Adding a Service
- Add raw manifests under
manifests/<area>or Helm values undervalues/. - Add an
Applicationinargocd/apps/. - Add any required DNS entries to both Pi-hole values files.
- Add certificates, secrets, and registry pull secrets if the service needs them.
- Commit and let the app-of-apps reconcile.
Use targetRevision: main for repo-managed services unless there is a specific
reason to track HEAD.