Nik Afiq
d0887ac648
Stage 5 + part of Stage 6/7 of REFACTOR_PLAN.md. This is the highest-risk stage per the plan -- these Applications are NOT to be pushed/synced blindly. Each needs `kubectl diff` against live state one at a time before enabling. New Applications (previously-live resources with zero GitOps coverage): - cert-manager-config.yaml (manifests/cert-manager: both ClusterIssuers + the internal CA Certificate -- every TLS cert in the cluster depends on these, and nothing currently restores them on a cold rebuild). - authentik-config.yaml (manifests/authentik: ingress, proxy outpost, middleware -- raw manifests only, low risk). - authentik.yaml (the Authentik Helm chart itself): sync is deliberately left MANUAL and targetRevision is a REPLACE_ME placeholder -- I don't have a safe way to read the live chart version (`helm list -n authentik`), and guessing wrong risks an unwanted upgrade/downgrade of the SSO IdP gating Argo CD/ Grafana/Gitea logins. Needs your input before this one goes anywhere. - network.yaml: widens coverage to the 4 non-sealed files in manifests/network (ddns-cronjob, glances-debian-ingress, traefik-dashboard-ingress, watch-party-ingress) that were previously invisible to Argo CD; keeps network-secrets.yaml scoped to *-sealed.yaml only. Fixes: - homeassistant.yaml: destination.namespace was "homeassistant" (empty, unused) while the actual resources are hardcoded to "default" -- corrected, dropped CreateNamespace=true. The old empty namespace isn't auto-deleted (prune: false); safe to remove by hand if desired. - gitea-backup.yaml: added the missing Namespace object (nothing created "gitea-backup" before); replaced a cluster-wide ClusterRole/ClusterRoleBinding granting pods/exec everywhere with a Role/RoleBinding scoped to the `gitea` namespace, matching what the backup script actually execs into. NOTE: this is already under active sync via gitea-secrets.yaml (selfHeal: true, prune: false) -- once pushed, the old ClusterRole/ClusterRoleBinding will need manual `kubectl delete` since Argo CD won't prune them. - Added sync-wave "-2" to cert-manager/sealed-secrets Applications so their CRDs land before consumers (matches the existing -1/0 wave pattern). - Normalized targetRevision HEAD -> main on home-services/otel-collector/tempo. - Normalized sync policy per your decision: home-services/otel-collector/tempo prune true -> false; pihole/pihole-debian selfHeal false -> true (repo-wide consistency, per your call on finding #18). Verified: kubeconform valid across all manifests + Argo CD Application objects. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Kubernetes Manifests
This directory contains raw Kubernetes resources grouped by service area. Most
subdirectories are consumed by Argo CD Applications in argocd/apps.
Directories
| Directory | Contents |
|---|---|
argocd/ |
App-of-apps, Argo CD ingress, Argo CD OIDC sealed secret |
authentik/ |
Authentik ingress, public ingress, proxy outpost, middleware, secret scripts |
cert-manager/ |
Internal and Let's Encrypt ClusterIssuers, Porkbun secret script |
core/ |
Dashy, Glances, CoreDNS custom config, CA installer |
gitea/ |
Gitea storage, backup, public ingress, runner and OIDC/admin secrets |
home-services/ |
HA gateway, AI gateway, Discord bot, service TLS, registry secret |
homeassistant/ |
Home Assistant external service and ingress |
media/ |
Jellyfin, qBittorrent, JDownloader, Immich |
monitoring/ |
Monitoring PVs, Grafana datasource, Grafana/Auth OIDC secrets |
network/ |
Pi-hole secrets, DDNS, Traefik dashboard, external host ingresses |
portfolio/ |
Portfolio deployment, ingress, registry pull secret |
Secrets
There are two patterns:
*-sealed.yamlfiles are safe to commit and are reconciled by Sealed Secrets.*.shscripts create runtime Secrets from.envdirectly in the cluster.
Use .env.example as the template for local secret names. kubeseal must point
at the in-cluster controller named sealed-secrets-controller in kube-system.
Regenerate committed sealed secrets with the matching script, then commit the resulting YAML. Runtime secret scripts should be run against the target cluster and should not produce committed plaintext.
Certificates
Internal services generally use internal-ca-issuer and home.arpa hostnames.
Public services use Let's Encrypt issuers and nik4nao.com hostnames.
The CA installer lives in core/ca-installer. Its ca-sync CronJob keeps the
served ca.crt and Apple mobileconfig in sync with the cert-manager CA secret.
DNS
Internal DNS records are configured in values/pihole.yaml and
values/pihole-debian.yaml. Add a new hostname to both files when adding a
home.arpa service.
Dashy
core/dashy.yaml defines the deployment and a placeholder ConfigMap. The real
dashboard config comes from config/dashy/conf.yaml:
bash manifests/core/apply-dashy-config.sh