Nik Afiq 9afc7e8005
Some checks failed
validate / lint (push) Failing after 1s
fix: resolve REPLACE_ME placeholder in argocd/apps/authentik.yaml
The placeholder targetRevision reached origin/main and broke the Application's
comparison (ComparisonError: "improper constraint: REPLACE_ME"), showing as a
broken card in the Argo CD UI. The actual Authentik pods were never affected
(sync policy has no `automated` block, so nothing was ever applied against the
live release) -- confirmed all authentik namespace pods stayed Running 1/1
throughout.

Fixed using the real deployed chart version read off the live authentik-server
pod's helm.sh/chart=authentik-2026.2.1 label, not a guess.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-23 18:47:51 +09:00
..

Argo CD

Argo CD is the cluster reconciler for this repo. manifests/argocd/app-of-apps.yaml points Argo CD at argocd/apps, where each file defines one child Application.

Bootstrap

Install or upgrade Argo CD with the pinned chart values:

helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm upgrade --install argocd argo/argo-cd \
  --namespace argocd --create-namespace \
  --version 9.4.15 \
  --values argocd/values/argocd.yaml

Then apply the app-of-apps:

kubectl apply -f manifests/argocd/app-of-apps.yaml

Argo CD is exposed at https://argocd.home.arpa by manifests/argocd/argocd.yaml.

Application Types

Type Examples Source
Helm chart plus values Traefik, cert-manager, Gitea, Pi-hole, monitoring, Loki, Tempo argocd/apps/*.yaml and values/*.yaml
Raw manifest directory Core, media, network secrets, home services, portfolio manifests/*
Argo CD self-management argocd-self, argocd-config argocd/values and manifests/argocd

Most Applications use automated sync with selfHeal: true and prune: false. Expect Argo CD to correct drift, but do not expect deleted Git resources to be pruned automatically.

Adding a Service

  1. Add raw manifests under manifests/<area> or Helm values under values/.
  2. Add an Application in argocd/apps/.
  3. Add any required DNS entries to both Pi-hole values files.
  4. Add certificates, secrets, and registry pull secrets if the service needs them.
  5. Commit and let the app-of-apps reconcile.

Use targetRevision: main for repo-managed services unless there is a specific reason to track HEAD.