Use direct Helm sources for existing Argo applications

apps/argocd/Chart.yaml

@@ -1,9 +0,0 @@
-apiVersion: v2
-name: argocd
-description: Self-managed Argo CD deployment for the homelab cluster
-type: application
-version: 0.1.0
-dependencies:
-- name: argo-cd
-  version: 10.10.5
-  repository: https://argoproj.github.io/argo-helm

apps/argocd/values.yaml

@@ -1,11 +1,10 @@
-argo-cd:
-  global:
+global:
     domain: cd.brunner.ninja
 
-  crds:
+crds:
     install: true
 
-  configs:
+configs:
     cm:
       oidc.config: |
         name: Authentik
@@ -26,14 +25,14 @@ argo-cd:
     params:
       server.insecure: true
 
-  notifications:
+notifications:
     secret:
       create: false
 
-  redisSecretInit:
+redisSecretInit:
     enabled: false
 
-  server:
+server:
     ingress:
       enabled: true
       annotations:

apps/brgkepler-com/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: brgkepler-com
-type: application
-version: 0.1.0
-dependencies:
-- name: php-homepage
-  version: 0.10.1
-  repository: https://brunner.ninja/charts

apps/brgkepler-com/values.yaml

@@ -1,23 +1,22 @@
-php-homepage:
-  fullnameOverride: brgkepler-com
-  apache:
-    serverAdmin: daniel@brunner.ninja
-  metrics:
+fullnameOverride: brgkepler-com
+apache:
+  serverAdmin: daniel@brunner.ninja
+metrics:
+  enabled: true
+  serviceMonitor:
     enabled: true
-    serviceMonitor:
-      enabled: true
-    prometheusRule:
-      enabled: true
-  persistence:
-    existingClaim: brgkepler-com
-  ingress:
+  prometheusRule:
     enabled: true
-    hosts:
-    - host: brgkepler.com
-      paths:
-      - path: /
-        pathType: Prefix
-    tls:
-    - hosts:
-      - brgkepler.com
-      secretName: brgkepler-com-tls
+persistence:
+  existingClaim: brgkepler-com
+ingress:
+  enabled: true
+  hosts:
+  - host: brgkepler.com
+    paths:
+    - path: /
+      pathType: Prefix
+  tls:
+  - hosts:
+    - brgkepler.com
+    secretName: brgkepler-com-tls

apps/brunner-ninja/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: brunner-ninja
-type: application
-version: 0.1.0
-dependencies:
-- name: php-homepage
-  version: 0.10.1
-  repository: https://brunner.ninja/charts

apps/brunner-ninja/values.yaml

@@ -1,23 +1,22 @@
-php-homepage:
-  fullnameOverride: brunner-ninja
-  apache:
-    serverAdmin: daniel@brunner.ninja
-  metrics:
+fullnameOverride: brunner-ninja
+apache:
+  serverAdmin: daniel@brunner.ninja
+metrics:
+  enabled: true
+  serviceMonitor:
     enabled: true
-    serviceMonitor:
-      enabled: true
-    prometheusRule:
-      enabled: true
-  persistence:
-    existingClaim: brunner-ninja
-  ingress:
+  prometheusRule:
     enabled: true
-    hosts:
-    - host: brunner.ninja
-      paths:
-      - path: /
-        pathType: Prefix
-    tls:
-    - hosts:
-      - brunner.ninja
-      secretName: brunner-ninja-tls
+persistence:
+  existingClaim: brunner-ninja
+ingress:
+  enabled: true
+  hosts:
+  - host: brunner.ninja
+    paths:
+    - path: /
+      pathType: Prefix
+  tls:
+  - hosts:
+    - brunner.ninja
+    secretName: brunner-ninja-tls

apps/flaresolverr/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: flaresolverr-homelab
-type: application
-version: 0.1.0
-dependencies:
-- name: flaresolverr
-  version: 6.2.0
-  repository: https://k8s-home-lab.github.io/helm-charts/

apps/flaresolverr/values.yaml

@@ -1,13 +1,12 @@
-flaresolverr:
-  image:
-    tag: v3.5.2
-  ingress:
-    main:
-      enabled: true
-      ingressClassName: traefik
-      hosts:
-      - host: flaresolverr.brunner.ninja
-        paths:
-        - path: /
-      annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+image:
+  tag: v3.5.2
+ingress:
+  main:
+    enabled: true
+    ingressClassName: traefik
+    hosts:
+    - host: flaresolverr.brunner.ninja
+      paths:
+      - path: /
+    annotations:
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure

apps/gschissenes-equipment/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: gschissenes-equipment
-type: application
-version: 0.1.0
-dependencies:
-- name: php-homepage
-  version: 0.10.1
-  repository: https://brunner.ninja/charts

apps/gschissenes-equipment/values.yaml

@@ -1,23 +1,22 @@
-php-homepage:
-  fullnameOverride: gschissenes-equipment
-  apache:
-    serverAdmin: daniel@brunner.ninja
-  metrics:
+fullnameOverride: gschissenes-equipment
+apache:
+  serverAdmin: daniel@brunner.ninja
+metrics:
+  enabled: true
+  serviceMonitor:
     enabled: true
-    serviceMonitor:
-      enabled: true
-    prometheusRule:
-      enabled: true
-  persistence:
-    existingClaim: gschissenes-equipment
-  ingress:
+  prometheusRule:
     enabled: true
-    hosts:
-    - host: gschissenes.equipment
-      paths:
-      - path: /
-        pathType: Prefix
-    tls:
-    - hosts:
-      - gschissenes.equipment
-      secretName: gschissenes-equipment-tls
+persistence:
+  existingClaim: gschissenes-equipment
+ingress:
+  enabled: true
+  hosts:
+  - host: gschissenes.equipment
+    paths:
+    - path: /
+      pathType: Prefix
+  tls:
+  - hosts:
+    - gschissenes.equipment
+    secretName: gschissenes-equipment-tls

apps/immich-crack/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: immich-crack
-type: application
-version: 0.1.0
-dependencies:
-- name: php-homepage
-  version: 0.10.1
-  repository: https://brunner.ninja/charts

apps/immich-crack/values.yaml

@@ -1,20 +1,19 @@
-php-homepage:
-  fullnameOverride: immich-crack
-  apache:
-    serverAdmin: daniel@brunner.ninja
-  metrics:
+fullnameOverride: immich-crack
+apache:
+  serverAdmin: daniel@brunner.ninja
+metrics:
+  enabled: true
+  serviceMonitor:
     enabled: true
-    serviceMonitor:
-      enabled: true
-    prometheusRule:
-      enabled: true
-  persistence:
-    existingClaim: immich-crack
-  ingress:
+  prometheusRule:
     enabled: true
-    hosts:
-    - host: immich-crack.brunner.ninja
-      paths:
-      - path: /
-        pathType: Prefix
-    tls: []
+persistence:
+  existingClaim: immich-crack
+ingress:
+  enabled: true
+  hosts:
+  - host: immich-crack.brunner.ninja
+    paths:
+    - path: /
+      pathType: Prefix
+  tls: []

apps/immichframe/Chart.yaml

@@ -1,9 +0,0 @@
-apiVersion: v2
-name: immichframe
-description: Cluster-specific ImmichFrame deployment
-type: application
-version: 0.1.0
-dependencies:
-- name: immichframe
-  version: 0.2.1
-  repository: https://brunner.ninja/charts

apps/immichframe/resources/immichframe-api.yaml

@@ -1,4 +1,3 @@
----
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:

apps/immichframe/values.yaml

@@ -1,13 +1,12 @@
-immichframe:
-  fullnameOverride: immichframe
-  replicaCount: 2
+fullnameOverride: immichframe
+replicaCount: 2
 
-  image:
+image:
     pullPolicy: Always
 
-  timezone: Europe/Vienna
+timezone: Europe/Vienna
 
-  config:
+config:
     general:
       Interval: 15
       ShowClock: false
@@ -20,7 +19,7 @@ immichframe:
         Albums:
         - 489d6c4d-d175-45e0-aeae-e2791dfc9658
 
-  ingress:
+ingress:
     enabled: true
     className: traefik
     annotations:
@@ -31,16 +30,16 @@ immichframe:
       - path: /
         pathType: Prefix
 
-  podDisruptionBudget:
+podDisruptionBudget:
     enabled: true
     minAvailable: 1
 
-  prometheusRule:
+prometheusRule:
     enabled: true
     labels:
       release: prometheus
 
-  resources:
+resources:
     requests:
       cpu: 10m
       memory: 256Mi

apps/metallb/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- https://raw.githubusercontent.com/metallb/metallb/v0.16.0/config/manifests/metallb-native.yaml
-- resources.yaml

apps/ombi/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: ombi-homelab
-type: application
-version: 0.1.0
-dependencies:
-- name: ombi
-  version: 12.2.1
-  repository: https://k8s-home-lab.github.io/helm-charts/

apps/ombi/values.yaml

@@ -1,22 +1,21 @@
-ombi:
-  image:
-    tag: 4.53.10
-  env:
-    TZ: Europe/Vienna
-  ingress:
-    main:
-      enabled: true
-      ingressClassName: traefik
-      hosts:
-      - host: ombi.brunner.ninja
-        paths:
-        - path: /
-      annotations:
-        traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-  persistence:
-    config:
-      enabled: true
-      size: 1Gi
-      storageClass: rook-ceph-block
-      accessMode: ReadWriteOnce
+image:
+  tag: 4.53.10
+env:
+  TZ: Europe/Vienna
+ingress:
+  main:
+    enabled: true
+    ingressClassName: traefik
+    hosts:
+    - host: ombi.brunner.ninja
+      paths:
+      - path: /
+    annotations:
+      traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+persistence:
+  config:
+    enabled: true
+    size: 1Gi
+    storageClass: rook-ceph-block
+    accessMode: ReadWriteOnce

apps/pfostendynamics-com/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: pfostendynamics-com
-type: application
-version: 0.1.0
-dependencies:
-- name: php-homepage
-  version: 0.10.1
-  repository: https://brunner.ninja/charts

apps/pfostendynamics-com/values.yaml

@@ -1,14 +1,13 @@
-php-homepage:
-  fullnameOverride: pfostendynamics-com
-  apache:
-    serverAdmin: daniel@brunner.ninja
-  metrics:
+fullnameOverride: pfostendynamics-com
+apache:
+  serverAdmin: daniel@brunner.ninja
+metrics:
+  enabled: true
+  serviceMonitor:
     enabled: true
-    serviceMonitor:
-      enabled: true
-    prometheusRule:
-      enabled: true
-  persistence:
-    existingClaim: pfostendynamics-com
-  ingress:
-    enabled: false
+  prometheusRule:
+    enabled: true
+persistence:
+  existingClaim: pfostendynamics-com
+ingress:
+  enabled: false

apps/tautulli/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: tautulli-homelab
-type: application
-version: 0.1.0
-dependencies:
-- name: tautulli
-  version: 12.3.0
-  repository: https://k8s-home-lab.github.io/helm-charts/

apps/tautulli/values.yaml

@@ -1,33 +1,32 @@
-tautulli:
-  image:
-    repository: lscr.io/linuxserver/tautulli
-    tag: 2.18.2
-  env:
-    TZ: Europe/Vienna
-  ingress:
-    main:
-      enabled: true
-      ingressClassName: traefik
-      service:
-        name: main
-        port: http
-      hosts:
-      - host: tautulli.brunner.ninja
-        paths:
-        - path: /
-          pathType: Prefix
-      annotations:
-        traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-  service:
-    main:
-      enabled: true
-      ports:
-        http:
-          port: 8181
-  persistence:
-    config:
-      enabled: true
-      size: 60Gi
-      storageClass: rook-ceph-block
-      accessMode: ReadWriteOnce
+image:
+  repository: lscr.io/linuxserver/tautulli
+  tag: 2.18.2
+env:
+  TZ: Europe/Vienna
+ingress:
+  main:
+    enabled: true
+    ingressClassName: traefik
+    service:
+      name: main
+      port: http
+    hosts:
+    - host: tautulli.brunner.ninja
+      paths:
+      - path: /
+        pathType: Prefix
+    annotations:
+      traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+service:
+  main:
+    enabled: true
+    ports:
+      http:
+        port: 8181
+persistence:
+  config:
+    enabled: true
+    size: 60Gi
+    storageClass: rook-ceph-block
+    accessMode: ReadWriteOnce

apps/uptime-kuma/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: uptime-kuma-homelab
-type: application
-version: 0.1.0
-dependencies:
-- name: uptime-kuma
-  version: 4.2.0
-  repository: https://helm.irsigler.cloud

apps/uptime-kuma/values.yaml

@@ -1,31 +1,30 @@
-uptime-kuma:
-  image:
-    pullPolicy: Always
-    tag: 2.5.6-rootless
-  imagePullSecrets:
-  - name: quay-pull-secret
-  ingress:
-    enabled: true
-    className: traefik
-    annotations:
-      traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
-      traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    hosts:
-    - host: status.brunner.ninja
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-  volume:
-    storageClassName: rook-ceph-block
-  strategy:
-    type: Recreate
-  readinessProbe:
-    timeoutSeconds: 5
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-      ephemeral-storage: 128Mi
-    limits:
-      memory: 1Gi
-      ephemeral-storage: 1Gi
+image:
+  pullPolicy: Always
+  tag: 2.5.6-rootless
+imagePullSecrets:
+- name: quay-pull-secret
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+  - host: status.brunner.ninja
+    paths:
+    - path: /
+      pathType: ImplementationSpecific
+volume:
+  storageClassName: rook-ceph-block
+strategy:
+  type: Recreate
+readinessProbe:
+  timeoutSeconds: 5
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+    ephemeral-storage: 128Mi
+  limits:
+    memory: 1Gi
+    ephemeral-storage: 1Gi

apps/watschn-studio/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: watschn-studio
-type: application
-version: 0.1.0
-dependencies:
-- name: php-homepage
-  version: 0.10.1
-  repository: https://brunner.ninja/charts

apps/watschn-studio/values.yaml

@@ -1,23 +1,22 @@
-php-homepage:
-  fullnameOverride: watschn-studio
-  apache:
-    serverAdmin: daniel@brunner.ninja
-  metrics:
+fullnameOverride: watschn-studio
+apache:
+  serverAdmin: daniel@brunner.ninja
+metrics:
+  enabled: true
+  serviceMonitor:
     enabled: true
-    serviceMonitor:
-      enabled: true
-    prometheusRule:
-      enabled: true
-  persistence:
-    existingClaim: watschn-studio
-  ingress:
+  prometheusRule:
     enabled: true
-    hosts:
-    - host: watschn.studio
-      paths:
-      - path: /
-        pathType: Prefix
-    tls:
-    - hosts:
-      - watschn.studio
-      secretName: watschn-studio-tls
+persistence:
+  existingClaim: watschn-studio
+ingress:
+  enabled: true
+  hosts:
+  - host: watschn.studio
+    paths:
+    - path: /
+      pathType: Prefix
+  tls:
+  - hosts:
+    - watschn.studio
+    secretName: watschn-studio-tls

apps/wiki-js/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: wiki-js-homelab
-type: application
-version: 0.1.0
-dependencies:
-- name: wiki
-  version: 3.0.0
-  repository: https://charts.js.wiki

apps/wiki-js/values.yaml

@@ -1,28 +1,27 @@
-wiki:
-  imagePullSecrets:
-  - name: quay-pull-secret
-  image:
-    repository: docker.io/requarks/wiki
-    tag: 2.5.316
-  ingress:
-    enabled: true
-    className: traefik
-    hosts:
-    - host: wiki.brunner.ninja
-      paths:
-      - path: /
-        pathType: Prefix
-    annotations:
-      traefik.ingress.kubernetes.io/router.entrypoints: websecure
-  postgresql:
+imagePullSecrets:
+- name: quay-pull-secret
+image:
+  repository: docker.io/requarks/wiki
+  tag: 2.5.316
+ingress:
+  enabled: true
+  className: traefik
+  hosts:
+  - host: wiki.brunner.ninja
+    paths:
+    - path: /
+      pathType: Prefix
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+postgresql:
+  enabled: false
+  persistence:
     enabled: false
-    persistence:
-      enabled: false
-  externalPostgresql:
-    host: postgresql.default.svc.cluster.local
-    port: "5432"
-    database: wikijs
-    username: wikijs
-    existingSecret: wiki-js
-    existingSecretKey: postgresql-password
-    ssl: false
+externalPostgresql:
+  host: postgresql.default.svc.cluster.local
+  port: "5432"
+  database: wikijs
+  username: wikijs
+  existingSecret: wiki-js
+  existingSecretKey: postgresql-password
+  ssl: false

bootstrap/argocd.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: argocd
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/argocd
+  sources:
+  - repoURL: https://argoproj.github.io/argo-helm
+    chart: argo-cd
+    targetRevision: 10.10.5
     helm:
       releaseName: argocd
+      valueFiles:
+      - $values/apps/argocd/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd

bootstrap/brgkepler-com.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/brgkepler-com
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: php-homepage
+    targetRevision: 0.10.1
     helm:
       releaseName: brgkepler-com
+      valueFiles:
+      - \$values/apps/brgkepler-com/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/brunner-ninja.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/brunner-ninja
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: php-homepage
+    targetRevision: 0.10.1
     helm:
       releaseName: brunner-ninja
+      valueFiles:
+      - \$values/apps/brunner-ninja/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/flaresolverr.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/flaresolverr
+  sources:
+  - repoURL: https://k8s-home-lab.github.io/helm-charts/
+    chart: flaresolverr
+    targetRevision: 6.2.0
     helm:
       releaseName: flaresolverr
+      valueFiles:
+      - \$values/apps/flaresolverr/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/gschissenes-equipment.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/gschissenes-equipment
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: php-homepage
+    targetRevision: 0.10.1
     helm:
       releaseName: gschissenes-equipment
+      valueFiles:
+      - \$values/apps/gschissenes-equipment/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/immich-crack.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/immich-crack
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: php-homepage
+    targetRevision: 0.10.1
     helm:
       releaseName: immich-crack
+      valueFiles:
+      - \$values/apps/immich-crack/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/immichframe.yaml

@@ -5,10 +5,20 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: immichframe
+    targetRevision: 0.2.1
+    helm:
+      releaseName: immichframe
+      valueFiles:
+      - $values/apps/immichframe/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
     targetRevision: main
-    path: apps/immichframe
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/immichframe/resources
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/metallb-project.yaml

@@ -7,6 +7,7 @@ spec:
   description: MetalLB controller and site-specific L2 configuration
   sourceRepos:
   - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  - https://metallb.github.io/metallb
   destinations:
   - namespace: metallb-system
     server: https://kubernetes.default.svc

bootstrap/metallb.yaml

@@ -5,10 +5,15 @@ metadata:
   namespace: argocd
 spec:
   project: metallb
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  sources:
+  - repoURL: https://metallb.github.io/metallb
+    chart: metallb
+    targetRevision: 0.16.0
+    helm:
+      releaseName: metallb
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
     targetRevision: main
-    path: apps/metallb
+    path: apps/metallb/resources
   destination:
     server: https://kubernetes.default.svc
     namespace: metallb-system

bootstrap/ombi.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/ombi
+  sources:
+  - repoURL: https://k8s-home-lab.github.io/helm-charts/
+    chart: ombi
+    targetRevision: 12.2.1
     helm:
       releaseName: ombi
+      valueFiles:
+      - \$values/apps/ombi/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/pfostendynamics-com.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/pfostendynamics-com
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: php-homepage
+    targetRevision: 0.10.1
     helm:
       releaseName: pfostendynamics-com
+      valueFiles:
+      - \$values/apps/pfostendynamics-com/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/project.yaml

@@ -7,6 +7,10 @@ spec:
   description: Applications managed from the public homelab GitOps repository
   sourceRepos:
   - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  - https://brunner.ninja/charts
+  - https://charts.js.wiki
+  - https://helm.irsigler.cloud
+  - https://k8s-home-lab.github.io/helm-charts/
   destinations:
   - namespace: default
     server: https://kubernetes.default.svc

bootstrap/tautulli.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/tautulli
+  sources:
+  - repoURL: https://k8s-home-lab.github.io/helm-charts/
+    chart: tautulli
+    targetRevision: 12.3.0
     helm:
       releaseName: tautulli
+      valueFiles:
+      - \$values/apps/tautulli/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/uptime-kuma.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/uptime-kuma
+  sources:
+  - repoURL: https://helm.irsigler.cloud
+    chart: uptime-kuma
+    targetRevision: 4.2.0
     helm:
       releaseName: uptime-kuma
+      valueFiles:
+      - \$values/apps/uptime-kuma/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/watschn-studio.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/watschn-studio
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: php-homepage
+    targetRevision: 0.10.1
     helm:
       releaseName: watschn-studio
+      valueFiles:
+      - \$values/apps/watschn-studio/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

bootstrap/wiki-js.yaml

@@ -5,12 +5,17 @@ metadata:
   namespace: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
-    targetRevision: main
-    path: apps/wiki-js
+  sources:
+  - repoURL: https://charts.js.wiki
+    chart: wiki
+    targetRevision: 3.0.0
     helm:
       releaseName: wiki-js
+      valueFiles:
+      - \$values/apps/wiki-js/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: default

docs/chart-ownership.md

@@ -0,0 +1,29 @@
+# Helm chart ownership and promotion
+
+This repository contains cluster policy and values, not application workload
+implementations. Deployments, StatefulSets, Services, ports, probes, mount
+paths, and configuration wiring belong to a published upstream or maintained
+Helm chart outside this repository.
+
+Each independently versioned application has one chart and one Argo CD
+Application. This includes each Artcraft application: WordCraft, GridCraft,
+DeckCraft, PhotoCraft, LightCraft, VectorCraft, FilmCraft, EffectCraft,
+DesignCraft, FigCraft, PdfCraft, SoundCraft, and CADCraft are separate releases,
+not one suite chart.
+
+Maintained chart repositories set `Chart.yaml.appVersion` to the tested
+application/image version. CI derives the chart package version from Git:
+
+- tag `v1.0.0` produces chart `1.0.0`;
+- the next commit produces a unique version such as
+  `1.0.0-1-g41627abcdef`.
+
+The hash is retained to prevent package-version collisions. CI publishes to
+`https://brunner.ninja/charts`, then uses `GITOPS_TOKEN` to update only the
+matching Argo Application's exact Helm `targetRevision`. Argo CD performs the
+deployment; chart CI never receives Kubernetes credentials.
+
+GitOps values may select namespaces, hostnames, ingress integration, existing
+claims or storage classes/sizes, resource sizing, replica counts, monitoring
+labels, and names of existing Secrets. They must not duplicate chart-owned
+image versions or resource topology.

scripts/update-chart-version.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: $0 APPLICATION CHART_VERSION" >&2
+  exit 2
+fi
+
+application=$1
+version=$2
+case "$application" in
+  ''|*[!a-z0-9-]*) echo "invalid application name: $application" >&2; exit 2 ;;
+esac
+case "$version" in
+  ''|*[!0-9A-Za-z.+-]*) echo "invalid chart version: $version" >&2; exit 2 ;;
+esac
+
+file="bootstrap/${application}.yaml"
+test -f "$file"
+tmp=$(mktemp)
+trap 'rm -f "$tmp"' EXIT
+
+awk -v version="$version" '
+  $1 == "chart:" && !chart { chart=1 }
+  chart && $1 == "targetRevision:" && !updated {
+    sub(/targetRevision:.*/, "targetRevision: " version)
+    updated=1
+  }
+  { print }
+  END { if (!updated) exit 3 }
+' "$file" > "$tmp"
+mv "$tmp" "$file"
+trap - EXIT

scripts/update-immichframe-chart.sh

@@ -1,36 +0,0 @@
-#!/bin/sh
-set -eu
-
-if [ "$#" -ne 1 ] || ! printf '%s\n' "$1" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$'; then
-  echo "usage: $0 <semantic-chart-version>" >&2
-  exit 2
-fi
-
-script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-repository_dir=$(dirname -- "${script_dir}")
-chart="${repository_dir}/apps/immichframe/Chart.yaml"
-temporary="${chart}.tmp"
-
-awk -v version="$1" '
-  /^- name: immichframe$/ {
-    dependency = 1
-  }
-  dependency && /^  version: / {
-    if (updated) {
-      print "multiple immichframe dependency versions found" > "/dev/stderr"
-      exit 1
-    }
-    print "  version: " version
-    updated = 1
-    dependency = 0
-    next
-  }
-  { print }
-  END {
-    if (!updated) {
-      print "immichframe dependency version not found" > "/dev/stderr"
-      exit 1
-    }
-  }
-' "${chart}" > "${temporary}"
-mv "${temporary}" "${chart}"