arcodange
d93fa9c8ae
Backoffice de modération (ADR kadans-dossier 0018) : le squelette et son chart sont mergés côté kadans-admin depuis le 03/08, mais rien ne l'enregistrait ici — aucune Application, rien de vivant sur le cluster. Compagnon « sans état » au sens du runbook (09-service-compagnon.md), même motif que kadans-jobs : ni base ni secret Vault propres, juste le namespace partagé `kadans`. La sécurité applicative vit côté kadans-api (requireAdmin, KADANS_ADMIN_EMAILS — déjà câblé là-bas). ⚠ Merger APRÈS que l'image kadans-admin:latest existe réellement sur le registre (kadans-admin!wire-deploiement, le workflow qui la construit) — sinon la première synchro tire dans le vide (ImagePullBackOff), le même piège déjà payé une fois côté kadans-jobs.
104 lines
4.3 KiB
YAML
104 lines
4.3 KiB
YAML
# Default values for argocd.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
gitea_applications:
|
|
url-shortener:
|
|
annotations: {}
|
|
# Le PVC live a un spec.volumeName épinglé (rebind du volume Longhorn) que
|
|
# le chart ne déclare pas : sans ceci, chaque sync tente de le vider et
|
|
# l'API le refuse (spec immuable) → SyncError permanent.
|
|
ignoreDifferences:
|
|
- kind: PersistentVolumeClaim
|
|
jsonPointers:
|
|
- /spec/volumeName
|
|
syncOptions:
|
|
- RespectIgnoreDifferences=true
|
|
tools:
|
|
annotations: {}
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
webapp:
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: webapp=gitea.arcodange.lab/arcodange-org/webapp:latest
|
|
argocd-image-updater.argoproj.io/webapp.update-strategy: digest
|
|
telegram-gateway:
|
|
org: arcodange
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: telegram-gateway=gitea.arcodange.lab/arcodange/telegram-gateway:latest
|
|
argocd-image-updater.argoproj.io/telegram-gateway.update-strategy: digest
|
|
erp:
|
|
annotations: {}
|
|
# Non-prod environments (ADR-0002). Each key renders an extra Application
|
|
# "<app>-<env>" overlaid with chart/values-<env>.yaml into namespace
|
|
# "<app>-<env>". Prod erp is unaffected.
|
|
envs:
|
|
sandbox: {}
|
|
cms:
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: cms=gitea.arcodange.lab/arcodange-org/cms:latest
|
|
argocd-image-updater.argoproj.io/cms.update-strategy: digest
|
|
dance-lessons-coach:
|
|
org: arcodange
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: dance-lessons-coach=gitea.arcodange.lab/arcodange/dance-lessons-coach:latest
|
|
argocd-image-updater.argoproj.io/dance-lessons-coach.update-strategy: digest
|
|
prospection:
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: prospection=gitea.arcodange.lab/arcodange-org/prospection:latest
|
|
argocd-image-updater.argoproj.io/prospection.update-strategy: digest
|
|
kadans:
|
|
org: arcodange
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: kadans=gitea.arcodange.lab/arcodange/kadans:latest
|
|
argocd-image-updater.argoproj.io/kadans.update-strategy: digest
|
|
kadans-jobs:
|
|
org: arcodange
|
|
# La façade d'analyse vit dans le namespace de l'app qu'elle sert.
|
|
namespace: kadans
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: kadans-jobs=gitea.arcodange.lab/arcodange/kadans-jobs:latest
|
|
argocd-image-updater.argoproj.io/kadans-jobs.update-strategy: digest
|
|
kadans-admin:
|
|
org: arcodange
|
|
# Backoffice de modération : ni base ni secret Vault propres (compagnon
|
|
# « sans état », cf. factory/doc/runbooks/new-web-app/09). La sécurité
|
|
# applicative vit côté kadans-api (requireAdmin, KADANS_ADMIN_EMAILS) ;
|
|
# ce chart n'expose qu'un ingress .lab.
|
|
namespace: kadans
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: kadans-admin=gitea.arcodange.lab/arcodange/kadans-admin:latest
|
|
argocd-image-updater.argoproj.io/kadans-admin.update-strategy: digest
|
|
kadans-api:
|
|
org: arcodange
|
|
# L'API cœur partage le stack Vault/DB « kadans » (VaultAuth, creds Postgres,
|
|
# policy KV) : elle vit donc dans le namespace de l'app front qu'elle sert.
|
|
namespace: kadans
|
|
annotations:
|
|
argocd-image-updater.argoproj.io/image-list: kadans-api=gitea.arcodange.lab/arcodange/kadans-api:latest
|
|
argocd-image-updater.argoproj.io/kadans-api.update-strategy: digest
|
|
|
|
argocd_image_updater_chart_values:
|
|
config:
|
|
argocd:
|
|
grpcWeb: false
|
|
serverAddress: "https://argocd.arcodange.lab/"
|
|
insecure: true
|
|
plaintext: true
|
|
# The lab CA, so the updater can talk to the Gitea registry over TLS.
|
|
# Go reads every file in /etc/ssl/certs on top of the bundle, so dropping our
|
|
# root in there (subPath — the image's own certs stay untouched) is enough.
|
|
# Without it every query died on "certificate signed by unknown authority"
|
|
# and no image was ever rolled out. The registry itself allows anonymous
|
|
# pulls, so no credentials are needed — trust was the only missing piece.
|
|
volumes:
|
|
- name: homelab-ca
|
|
configMap:
|
|
name: homelab-ca
|
|
volumeMounts:
|
|
- name: homelab-ca
|
|
mountPath: /etc/ssl/certs/arcodange-root.crt
|
|
subPath: arcodange-root.crt
|
|
readOnly: true
|