Add Ghostfolio Argo CD deployment

apps/ghostfolio-postgresql/values.yaml

@@ -0,0 +1,16 @@
+auth:
+  username: ghostfolio
+  database: ghostfolio
+  existingSecret: ghostfolio-postgres
+  secretKeys:
+    adminPasswordKey: postgres-password
+    userPasswordKey: password
+
+primary:
+  persistence:
+    storageClass: rook-ceph-block
+    size: 8Gi
+  persistentVolumeClaimRetentionPolicy:
+    enabled: true
+    whenDeleted: Retain
+    whenScaled: Retain

apps/ghostfolio-valkey/values.yaml

@@ -0,0 +1,23 @@
+fullnameOverride: ghostfolio-valkey
+
+dataStorage:
+  enabled: true
+  requestedSize: 2Gi
+  className: rook-ceph-block
+  keepPvc: true
+
+auth:
+  enabled: true
+  usersExistingSecret: ghostfolio-valkey
+  aclUsers:
+    default:
+      permissions: "~* &* +@all"
+      passwordKey: password
+
+readinessProbe:
+  enabled: true
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 64Mi

apps/ghostfolio/README.md

@@ -0,0 +1,21 @@
+# Ghostfolio
+
+This Argo CD deployment runs in the dedicated `ghostfolio` namespace. Its
+PostgreSQL and Valkey services are separate Argo Applications in that same
+namespace rather than shared services from `default`.
+
+The upstream Ghostfolio chart currently lags the application release and its
+cache dependency is Redis rather than Valkey. GitOps therefore uses the
+chart's supported external-service settings to connect to the dedicated
+same-namespace services, and overrides only the Ghostfolio image tag. The
+release-specific image selection lives in `values.yaml`; remove that override
+when the upstream chart's `appVersion` catches up.
+
+`ghostfolio-auth` and the database/cache credentials are strict-scope
+SealedSecrets declared in `bootstrap/ghostfolio-secrets.yaml`. Never put their
+cleartext values in this directory.
+
+The migration uses a logical dump/restore for the Ghostfolio database. The old
+`default/postgresql` database is intentionally retained as a recovery copy;
+do not drop it as routine cleanup. Valkey is a cache/queue dependency and is
+started clean in its dedicated instance.

apps/ghostfolio/values.yaml

@@ -0,0 +1,110 @@
+# The upstream chart has not kept up with Ghostfolio releases. This tag-only
+# override selects the current application release while retaining the latest
+# chart package; remove it once a newer chart appVersion catches up.
+image:
+  repository: ghostfolio/ghostfolio
+  tag: 3.89.0
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 384Mi
+  limits:
+    cpu: "1"
+    memory: 1Gi
+
+startupProbe:
+  httpGet:
+    path: /api/v1/health
+    port: http
+  failureThreshold: 30
+  periodSeconds: 10
+  timeoutSeconds: 3
+
+readinessProbe:
+  httpGet:
+    path: /api/v1/health
+    port: http
+  failureThreshold: 3
+  periodSeconds: 10
+  timeoutSeconds: 3
+
+livenessProbe:
+  httpGet:
+    path: /api/v1/health
+    port: http
+  failureThreshold: 3
+  periodSeconds: 30
+  timeoutSeconds: 3
+
+serviceAccount:
+  automount: false
+
+ghostfolio:
+  # These stable placeholders only satisfy the chart-generated Secret. The
+  # Deployment explicitly overrides both env vars from ghostfolio-auth below.
+  ACCESS_TOKEN_SALT: managed-by-sealed-secrets
+  JWT_SECRET_KEY: managed-by-sealed-secrets
+  BASE_CURRENCY: EUR
+  existingSecret: ghostfolio-auth
+
+postgresql:
+  enabled: false
+
+externalPostgresql:
+  host: ghostfolio-postgresql.ghostfolio.svc.cluster.local
+  port: 5432
+  auth:
+    username: ghostfolio
+    database: ghostfolio
+    existingSecret: ghostfolio-postgres
+    secretKeys:
+      userPasswordKey: password
+  options: connect_timeout=300&sslmode=disable
+
+redis:
+  enabled: false
+
+externalRedis:
+  host: ghostfolio-valkey.ghostfolio.svc.cluster.local
+  port: 6379
+  auth:
+    enabled: true
+    existingSecret: ghostfolio-valkey
+    existingSecretPasswordKey: password
+
+ingress:
+  enabled: false
+  className: traefik
+  hosts:
+    - host: ghostfolio.brunner.ninja
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+
+extraManifests:
+  - apiVersion: monitoring.coreos.com/v1
+    kind: PrometheusRule
+    metadata:
+      name: ghostfolio
+      labels:
+        release: prometheus
+    spec:
+      groups:
+        - name: ghostfolio
+          rules:
+            - alert: GhostfolioUnavailable
+              expr: kube_deployment_status_replicas_available{namespace="ghostfolio", deployment="ghostfolio"} < 1
+              for: 5m
+              labels:
+                severity: critical
+              annotations:
+                summary: Ghostfolio has no available replicas
+            - alert: GhostfolioContainerRestarting
+              expr: increase(kube_pod_container_status_restarts_total{namespace="ghostfolio", container="ghostfolio"}[15m]) > 2
+              labels:
+                severity: warning
+              annotations:
+                summary: Ghostfolio is repeatedly restarting