# Default values for argocd.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
gitea_applications:
  url-shortener:
    annotations: {}
    # Le PVC live a un spec.volumeName épinglé (rebind du volume Longhorn) que
    # le chart ne déclare pas : sans ceci, chaque sync tente de le vider et
    # l'API le refuse (spec immuable) → SyncError permanent.
    ignoreDifferences:
      - kind: PersistentVolumeClaim
        jsonPointers:
          - /spec/volumeName
    syncOptions:
      - RespectIgnoreDifferences=true
  tools:
    annotations: {}
    syncPolicy:
      automated:
        prune: true
        selfHeal: true
  webapp:
    annotations:
      argocd-image-updater.argoproj.io/image-list: webapp=gitea.arcodange.lab/arcodange-org/webapp:latest
      argocd-image-updater.argoproj.io/webapp.update-strategy: digest
  telegram-gateway:
    org: arcodange
    annotations:
      argocd-image-updater.argoproj.io/image-list: telegram-gateway=gitea.arcodange.lab/arcodange/telegram-gateway:latest
      argocd-image-updater.argoproj.io/telegram-gateway.update-strategy: digest
  erp:
    annotations: {}
    # Non-prod environments (ADR-0002). Each key renders an extra Application
    # "<app>-<env>" overlaid with chart/values-<env>.yaml into namespace
    # "<app>-<env>". Prod erp is unaffected.
    envs:
      sandbox: {}
  cms:
    annotations:
      argocd-image-updater.argoproj.io/image-list: cms=gitea.arcodange.lab/arcodange-org/cms:latest
      argocd-image-updater.argoproj.io/cms.update-strategy: digest
  dance-lessons-coach:
    org: arcodange
    annotations:
      argocd-image-updater.argoproj.io/image-list: dance-lessons-coach=gitea.arcodange.lab/arcodange/dance-lessons-coach:latest
      argocd-image-updater.argoproj.io/dance-lessons-coach.update-strategy: digest
  prospection:
    annotations:
      argocd-image-updater.argoproj.io/image-list: prospection=gitea.arcodange.lab/arcodange-org/prospection:latest
      argocd-image-updater.argoproj.io/prospection.update-strategy: digest
  kadans:
    org: arcodange
    annotations:
      argocd-image-updater.argoproj.io/image-list: kadans=gitea.arcodange.lab/arcodange/kadans:latest
      argocd-image-updater.argoproj.io/kadans.update-strategy: digest
  kadans-jobs:
    org: arcodange
    # La façade d'analyse vit dans le namespace de l'app qu'elle sert.
    namespace: kadans
    annotations:
      argocd-image-updater.argoproj.io/image-list: kadans-jobs=gitea.arcodange.lab/arcodange/kadans-jobs:latest
      argocd-image-updater.argoproj.io/kadans-jobs.update-strategy: digest
  kadans-admin:
    org: arcodange
    # Backoffice de modération : ni base ni secret Vault propres (compagnon
    # « sans état », cf. factory/doc/runbooks/new-web-app/09). La sécurité
    # applicative vit côté kadans-api (requireAdmin, KADANS_ADMIN_EMAILS) ;
    # ce chart n'expose qu'un ingress .lab.
    namespace: kadans
    annotations:
      argocd-image-updater.argoproj.io/image-list: kadans-admin=gitea.arcodange.lab/arcodange/kadans-admin:latest
      argocd-image-updater.argoproj.io/kadans-admin.update-strategy: digest
  kadans-api:
    org: arcodange
    # L'API cœur partage le stack Vault/DB « kadans » (VaultAuth, creds Postgres,
    # policy KV) : elle vit donc dans le namespace de l'app front qu'elle sert.
    namespace: kadans
    annotations:
      argocd-image-updater.argoproj.io/image-list: kadans-api=gitea.arcodange.lab/arcodange/kadans-api:latest
      argocd-image-updater.argoproj.io/kadans-api.update-strategy: digest

argocd_image_updater_chart_values:
  config:
    argocd:
      grpcWeb: false
      serverAddress: "https://argocd.arcodange.lab/"
      insecure: true
      plaintext: true
  # The lab CA, so the updater can talk to the Gitea registry over TLS.
  # Go reads every file in /etc/ssl/certs on top of the bundle, so dropping our
  # root in there (subPath — the image's own certs stay untouched) is enough.
  # Without it every query died on "certificate signed by unknown authority"
  # and no image was ever rolled out. The registry itself allows anonymous
  # pulls, so no credentials are needed — trust was the only missing piece.
  volumes:
    - name: homelab-ca
      configMap:
        name: homelab-ca
  volumeMounts:
    - name: homelab-ca
      mountPath: /etc/ssl/certs/arcodange-root.crt
      subPath: arcodange-root.crt
      readOnly: true