From f4333039027bbaeb7a040dac354fe43d0822b63e Mon Sep 17 00:00:00 2001 From: 0xFEEDC0DE64 Date: Mon, 19 Oct 2026 07:56:23 +0200 Subject: [PATCH] Adopt Brave Sync and cert-manager with Argo CD --- apps/brave-sync/values.yaml | 4 ++ apps/cert-manager/README.md | 24 +++++++ apps/cert-manager/resources/certificates.yaml | 68 +++++++++++++++++++ .../resources/cluster-issuers.yaml | 36 ++++++++++ apps/cert-manager/values.yaml | 6 ++ bootstrap/brave-sync.yaml | 28 ++++++++ bootstrap/cert-manager.yaml | 31 +++++++++ bootstrap/kustomization.yaml | 2 + 8 files changed, 199 insertions(+) create mode 100644 apps/brave-sync/values.yaml create mode 100644 apps/cert-manager/README.md create mode 100644 apps/cert-manager/resources/certificates.yaml create mode 100644 apps/cert-manager/resources/cluster-issuers.yaml create mode 100644 apps/cert-manager/values.yaml create mode 100644 bootstrap/brave-sync.yaml create mode 100644 bootstrap/cert-manager.yaml diff --git a/apps/brave-sync/values.yaml b/apps/brave-sync/values.yaml new file mode 100644 index 0000000..0d6551b --- /dev/null +++ b/apps/brave-sync/values.yaml @@ -0,0 +1,4 @@ +host: sync.brunner.ninja +ingressClassName: traefik +clusterIssuer: letsencrypt-dns +storageClassName: rook-ceph-block diff --git a/apps/cert-manager/README.md b/apps/cert-manager/README.md new file mode 100644 index 0000000..d790ea5 --- /dev/null +++ b/apps/cert-manager/README.md @@ -0,0 +1,24 @@ +# cert-manager + +Argo CD installs the upstream Jetstack chart `v1.21.2` and owns the controller, +webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two +homelab ClusterIssuers and four centrally managed Certificates. Other +Certificates, including those created from Ingress annotations, remain owned +by their respective applications or controllers. + +The chart uses the existing `cert-manager` namespace and the existing +`kube-system` leader-election namespace. Its CRDs carry the upstream Helm +`resource-policy: keep` annotation, so Argo will preserve them if the chart is +removed; review CRD changes carefully during upgrades. + +Secrets stay cluster-managed. Before rebuilding the cluster, restore +`cert-manager/cloudflare-api-credentials` with its `apiKey` entry. cert-manager +creates and retains the ACME account Secrets +`letsencrypt-dns-account-key` and `letsencrypt-http-account-key` in its +namespace. The resulting TLS Secrets remain in `default` for Ingresses to +reference. No Secret values are stored here. + +For a local recovery install, read the chart version and values from +[`bootstrap/cert-manager.yaml`](../../bootstrap/cert-manager.yaml) and +[`values.yaml`](values.yaml). Normal upgrades are made by changing that +Application's chart `targetRevision` and allowing Argo CD to reconcile it. diff --git a/apps/cert-manager/resources/certificates.yaml b/apps/cert-manager/resources/certificates.yaml new file mode 100644 index 0000000..97b8eb2 --- /dev/null +++ b/apps/cert-manager/resources/certificates.yaml @@ -0,0 +1,68 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: brunner-ninja + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + secretName: brunner-ninja-tls + issuerRef: + name: letsencrypt-dns + kind: ClusterIssuer + dnsNames: + - brunner.ninja + - "*.brunner.ninja" + privateKey: + rotationPolicy: Always +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: watschn-studio + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + secretName: watschn-studio-tls + issuerRef: + name: letsencrypt-dns + kind: ClusterIssuer + dnsNames: + - watschn.studio + privateKey: + rotationPolicy: Always +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: brgkepler-com + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + secretName: brgkepler-com-tls + issuerRef: + name: letsencrypt-http + kind: ClusterIssuer + dnsNames: + - brgkepler.com + privateKey: + rotationPolicy: Always +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gschissenes-equipment + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + secretName: gschissenes-equipment-tls + issuerRef: + name: letsencrypt-http + kind: ClusterIssuer + dnsNames: + - gschissenes.equipment + privateKey: + rotationPolicy: Always diff --git a/apps/cert-manager/resources/cluster-issuers.yaml b/apps/cert-manager/resources/cluster-issuers.yaml new file mode 100644 index 0000000..547b5fe --- /dev/null +++ b/apps/cert-manager/resources/cluster-issuers.yaml @@ -0,0 +1,36 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-dns + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + acme: + email: daniel@brunner.ninja + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-dns-account-key + solvers: + - dns01: + cloudflare: + email: daniel@brunner.ninja + apiKeySecretRef: + name: cloudflare-api-credentials + key: apiKey +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-http + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + acme: + email: daniel@brunner.ninja + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-http-account-key + solvers: + - http01: + ingress: + ingressClassName: traefik diff --git a/apps/cert-manager/values.yaml b/apps/cert-manager/values.yaml new file mode 100644 index 0000000..f5c537f --- /dev/null +++ b/apps/cert-manager/values.yaml @@ -0,0 +1,6 @@ +crds: + enabled: true + +extraArgs: + - --dns01-recursive-nameservers-only + - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53 diff --git a/bootstrap/brave-sync.yaml b/bootstrap/brave-sync.yaml new file mode 100644 index 0000000..95fbad9 --- /dev/null +++ b/bootstrap/brave-sync.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: brave-sync + namespace: argocd +spec: + project: brave-sync + sources: + - repoURL: https://brunner.ninja/charts + chart: brave-sync + targetRevision: 0.1.1-r6 + helm: + releaseName: brave-sync + valueFiles: + - $values/apps/brave-sync/values.yaml + - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: brave-sync + syncPolicy: + automated: + enabled: true + prune: false + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/bootstrap/cert-manager.yaml b/bootstrap/cert-manager.yaml new file mode 100644 index 0000000..8ceda38 --- /dev/null +++ b/bootstrap/cert-manager.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd +spec: + project: cert-manager + sources: + - repoURL: https://charts.jetstack.io + chart: cert-manager + targetRevision: v1.21.2 + helm: + releaseName: cert-manager + valueFiles: + - $values/apps/cert-manager/values.yaml + - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git + targetRevision: main + ref: values + - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git + targetRevision: main + path: apps/cert-manager/resources + destination: + server: https://kubernetes.default.svc + namespace: cert-manager + syncPolicy: + automated: + enabled: true + prune: false + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml index 37f86c8..3ea2d2b 100644 --- a/bootstrap/kustomization.yaml +++ b/bootstrap/kustomization.yaml @@ -15,6 +15,8 @@ resources: - asciinema.yaml - brave-sync-project.yaml - cert-manager-project.yaml +- brave-sync.yaml +- cert-manager.yaml - metallb-project.yaml - metallb.yaml - brgkepler-com.yaml