Phase D4 of ADR-0002 — the final, GitOps step. Adds envs: { sandbox: {} } to the erp entry in argocd/values.yaml, so the Phase B per-env loop renders an extra erp-sandbox Application.
On merge to main, the factory app-of-apps re-renders and ArgoCD creates the erp-sandbox Application → deploys the Dolibarr chart (values.yaml + values-sandbox.yaml) into namespace erp-sandbox. The pod's VSO consumes the Vault paths from D2/D3 and the DB from D1.
Render diff (verified) — purely additive
The only change vs main is the new erp-sandbox Application; prod erp + all other apps render byte-identical:
Investigated: *.arcodange.lab is a wildcard in Pi-hole (k3s CoreDNS forwards to it), and cert-manager holds a *.arcodange.lab wildcard cert set as Traefik's default TLS. So erp-sandbox.arcodange.lab resolves + gets HTTPS automatically once the ingress is up — no DNS record or cert change. The only Phase E remnant is creating the write-scoped ai_agent_sandbox Dolibarr user (UI), which feeds the future V9 write skill.
## Summary
**Phase D4** of [ADR-0002](https://gitea.arcodange.lab/arcodange-org/factory/src/branch/main/vibe/ADR/0002-per-application-environments.md) — the final, GitOps step. Adds `envs: { sandbox: {} }` to the erp entry in `argocd/values.yaml`, so the Phase B per-env loop renders an extra `erp-sandbox` Application.
On merge to main, the factory app-of-apps re-renders and ArgoCD creates the `erp-sandbox` Application → deploys the Dolibarr chart (`values.yaml` + `values-sandbox.yaml`) into namespace `erp-sandbox`. The pod's VSO consumes the Vault paths from D2/D3 and the DB from D1.
### Render diff (verified) — purely additive
The only change vs main is the new `erp-sandbox` Application; prod `erp` + all other apps render byte-identical:
```
name: erp-sandbox
spec:
source:
repoURL: https://gitea.arcodange.lab/arcodange-org/erp
path: chart
helm:
valueFiles: [values.yaml, values-sandbox.yaml]
destination:
namespace: erp-sandbox
syncPolicy: { automated: { prune: true, selfHeal: true }, syncOptions: [CreateNamespace=true] }
```
### Phase E (DNS/TLS) — nothing needed
Investigated: `*.arcodange.lab` is a wildcard in Pi-hole (k3s CoreDNS forwards to it), and cert-manager holds a `*.arcodange.lab` wildcard cert set as Traefik's default TLS. So `erp-sandbox.arcodange.lab` resolves + gets HTTPS automatically once the ingress is up — no DNS record or cert change. The only Phase E remnant is creating the write-scoped `ai_agent_sandbox` Dolibarr user (UI), which feeds the future V9 write skill.
### Phase D — complete
| step | repo | PR | result |
|---|---|---|---|
| D1 Postgres DB+role | factory | [#17](https://gitea.arcodange.lab/arcodange-org/factory/pulls/17) | 6 added, 0 destroyed |
| D2 Vault policies | tools | [#3](https://gitea.arcodange.lab/arcodange-org/tools/pulls/3) | 1 add, 1 change, 0 destroy |
| D3 erp Vault auth/creds/KV | erp | [#12](https://gitea.arcodange.lab/arcodange-org/erp/pulls/12) | 5 moved, 5 added, 0 destroyed |
| **D4 ArgoCD app** (this) | factory | — | render additive |
🤖 Generated with [Claude Code](https://claude.com/claude-code)
ADR-0002 Phase D, final step. Adds `envs: { sandbox: {} }` to the erp entry
in argocd/values.yaml, so the Phase B per-env loop in templates/apps.yaml
renders an extra Application "erp-sandbox":
- source: same erp repo + chart, overlaid with values.yaml + values-sandbox.yaml
- destination namespace: erp-sandbox (CreateNamespace=true)
- syncPolicy: automated prune + selfHeal (default)
GitOps activation: on merge to main, the factory app-of-apps re-renders and
ArgoCD creates the erp-sandbox Application, which deploys the Dolibarr chart
into the erp-sandbox namespace. The pod's VSO reads the Vault paths created in
D2/D3 (auth/kubernetes/role/erp-sandbox, postgres/creds/erp-sandbox,
kvv2/erp-sandbox/config) and connects to the erp-sandbox DB created in D1.
Render verified: the only diff vs main is the added erp-sandbox Application;
prod erp + all other apps render byte-identical.
No DNS/TLS change needed (Phase E): *.arcodange.lab is a wildcard in Pi-hole
(CoreDNS forwards to it) and cert-manager holds a *.arcodange.lab wildcard set
as Traefik's default TLS — so erp-sandbox.arcodange.lab resolves + gets HTTPS
automatically once the ingress is up.
Completes Phase D. D1=factory#17, D2=tools#3, D3=erp#12 (all merged).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Phase D4 of ADR-0002 — the final, GitOps step. Adds
envs: { sandbox: {} }to the erp entry inargocd/values.yaml, so the Phase B per-env loop renders an extraerp-sandboxApplication.On merge to main, the factory app-of-apps re-renders and ArgoCD creates the
erp-sandboxApplication → deploys the Dolibarr chart (values.yaml+values-sandbox.yaml) into namespaceerp-sandbox. The pod's VSO consumes the Vault paths from D2/D3 and the DB from D1.Render diff (verified) — purely additive
The only change vs main is the new
erp-sandboxApplication; proderp+ all other apps render byte-identical:Phase E (DNS/TLS) — nothing needed
Investigated:
*.arcodange.labis a wildcard in Pi-hole (k3s CoreDNS forwards to it), and cert-manager holds a*.arcodange.labwildcard cert set as Traefik's default TLS. Soerp-sandbox.arcodange.labresolves + gets HTTPS automatically once the ingress is up — no DNS record or cert change. The only Phase E remnant is creating the write-scopedai_agent_sandboxDolibarr user (UI), which feeds the future V9 write skill.Phase D — complete
🤖 Generated with Claude Code
ADR-0002 Phase D, final step. Adds `envs: { sandbox: {} }` to the erp entry in argocd/values.yaml, so the Phase B per-env loop in templates/apps.yaml renders an extra Application "erp-sandbox": - source: same erp repo + chart, overlaid with values.yaml + values-sandbox.yaml - destination namespace: erp-sandbox (CreateNamespace=true) - syncPolicy: automated prune + selfHeal (default) GitOps activation: on merge to main, the factory app-of-apps re-renders and ArgoCD creates the erp-sandbox Application, which deploys the Dolibarr chart into the erp-sandbox namespace. The pod's VSO reads the Vault paths created in D2/D3 (auth/kubernetes/role/erp-sandbox, postgres/creds/erp-sandbox, kvv2/erp-sandbox/config) and connects to the erp-sandbox DB created in D1. Render verified: the only diff vs main is the added erp-sandbox Application; prod erp + all other apps render byte-identical. No DNS/TLS change needed (Phase E): *.arcodange.lab is a wildcard in Pi-hole (CoreDNS forwards to it) and cert-manager holds a *.arcodange.lab wildcard set as Traefik's default TLS — so erp-sandbox.arcodange.lab resolves + gets HTTPS automatically once the ingress is up. Completes Phase D. D1=factory#17, D2=tools#3, D3=erp#12 (all merged). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>