Adopt Brave Sync and cert-manager with Argo CD

2026-10-19 07:56:23 +02:00
parent 8b81c1ed7c
commit f433303902
8 changed files with 199 additions and 0 deletions
@@ -0,0 +1,4 @@
+host: sync.brunner.ninja
+ingressClassName: traefik
+clusterIssuer: letsencrypt-dns
+storageClassName: rook-ceph-block
@@ -0,0 +1,24 @@
+# cert-manager
+
+Argo CD installs the upstream Jetstack chart `v1.21.2` and owns the controller,
+webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
+homelab ClusterIssuers and four centrally managed Certificates. Other
+Certificates, including those created from Ingress annotations, remain owned
+by their respective applications or controllers.
+
+The chart uses the existing `cert-manager` namespace and the existing
+`kube-system` leader-election namespace. Its CRDs carry the upstream Helm
+`resource-policy: keep` annotation, so Argo will preserve them if the chart is
+removed; review CRD changes carefully during upgrades.
+
+Secrets stay cluster-managed. Before rebuilding the cluster, restore
+`cert-manager/cloudflare-api-credentials` with its `apiKey` entry. cert-manager
+creates and retains the ACME account Secrets
+`letsencrypt-dns-account-key` and `letsencrypt-http-account-key` in its
+namespace. The resulting TLS Secrets remain in `default` for Ingresses to
+reference. No Secret values are stored here.
+
+For a local recovery install, read the chart version and values from
+[`bootstrap/cert-manager.yaml`](../../bootstrap/cert-manager.yaml) and
+[`values.yaml`](values.yaml). Normal upgrades are made by changing that
+Application's chart `targetRevision` and allowing Argo CD to reconcile it.
@@ -0,0 +1,68 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: brunner-ninja
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  secretName: brunner-ninja-tls
+  issuerRef:
+    name: letsencrypt-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - brunner.ninja
+    - "*.brunner.ninja"
+  privateKey:
+    rotationPolicy: Always
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: watschn-studio
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  secretName: watschn-studio-tls
+  issuerRef:
+    name: letsencrypt-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - watschn.studio
+  privateKey:
+    rotationPolicy: Always
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: brgkepler-com
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  secretName: brgkepler-com-tls
+  issuerRef:
+    name: letsencrypt-http
+    kind: ClusterIssuer
+  dnsNames:
+    - brgkepler.com
+  privateKey:
+    rotationPolicy: Always
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gschissenes-equipment
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  secretName: gschissenes-equipment-tls
+  issuerRef:
+    name: letsencrypt-http
+    kind: ClusterIssuer
+  dnsNames:
+    - gschissenes.equipment
+  privateKey:
+    rotationPolicy: Always
@@ -0,0 +1,36 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-dns
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  acme:
+    email: daniel@brunner.ninja
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-dns-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            email: daniel@brunner.ninja
+            apiKeySecretRef:
+              name: cloudflare-api-credentials
+              key: apiKey
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-http
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  acme:
+    email: daniel@brunner.ninja
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-http-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: traefik
@@ -0,0 +1,6 @@
+crds:
+  enabled: true
+
+extraArgs:
+  - --dns01-recursive-nameservers-only
+  - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53
@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: brave-sync
+  namespace: argocd
+spec:
+  project: brave-sync
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: brave-sync
+    targetRevision: 0.1.1-r6
+    helm:
+      releaseName: brave-sync
+      valueFiles:
+      - $values/apps/brave-sync/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: brave-sync
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+spec:
+  project: cert-manager
+  sources:
+  - repoURL: https://charts.jetstack.io
+    chart: cert-manager
+    targetRevision: v1.21.2
+    helm:
+      releaseName: cert-manager
+      valueFiles:
+      - $values/apps/cert-manager/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/cert-manager/resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
@@ -15,6 +15,8 @@ resources:
 - asciinema.yaml
 - brave-sync-project.yaml
 - cert-manager-project.yaml
+- brave-sync.yaml
+- cert-manager.yaml
 - metallb-project.yaml
 - metallb.yaml
 - brgkepler-com.yaml