basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
92 commits 7 branches 0 tags 2.5 MiB
Commit graph

11 commits

Author SHA1 Message Date
CTO Agent
1ed15d98ea Fix argocd-cm ConfigMap YAML structure 
Move metadata.name and app.kubernetes.io/part-of label from data section
to proper metadata section. This was causing kustomize build failures.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:34:28 +00:00
CTO Agent
7b6a0064b9 Move Application manifests to apps root for proper self-management 
Move all Application manifests (app-*.yaml) out of apps/argocd/ to apps/
to avoid chicken-and-egg issue where Applications couldn't update themselves.

Architecture:
- apps/app-stack-basicstack-de.yaml: manages apps/** excluding argocd/**
- apps/app-argocd.yaml: manages apps/argocd/** via kustomize
- apps/app-basicstack-org.yaml: manages basicstack.org repo

This enables full self-management: all Applications can sync their own
configurations from git.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:27:28 +00:00
CTO Agent
68adf00375 Fix argocd exclusion pattern in stack Application 
Fully exclude argocd directory from stack Application to prevent
namespace errors. The argocd Application (apps/app-argocd.yaml) handles
all argocd resources via kustomize.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:26:12 +00:00
CTO Agent
fe9301f891 Enable Argo CD self-management via dedicated Application 
Create app-argocd Application to manage argocd resources using kustomize.
Update stack Application exclusion to allow Application manifests while
excluding direct resource management (prevents namespace errors from
directory recursion bypassing kustomization).

Architecture:
- stack Application manages Application manifests (app-*.yaml)
- argocd Application manages argocd resources via kustomize
- Both Applications can self-manage through this pattern

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:25:19 +00:00
CTO Agent
8f537b8f82 Test Argo CD self-management with argocd-cm annotation 
Add test annotation to argocd-cm ConfigMap to verify that Argo CD
automatically syncs changes to its own configuration.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:22:39 +00:00
CTO Agent
ba748d6ab4 Enable Argo CD self-management by removing argocd exclusion 
This allows the stack Application to manage Argo CD's own configuration
via GitOps, implementing the app-of-apps pattern.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:20:18 +00:00
CTO Agent
4f979d657e Add Argo CD Application for basicstack.org 
Deploys the basicstack.org website from Forgejo repository.
- Uses internal Forgejo URL (forgejo.forgejo.svc.cluster.local)
- Automated sync with prune and selfHeal enabled
- Deploys to basicstack-web namespace

Closes DEV-272

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:19:28 +00:00
CTO Agent
f75b51c02d Add Argo CD Application for stack.basicstack.de GitOps management 
Creates the Argo CD Application that manages all cluster infrastructure
applications from the stack.basicstack.de repository. Configuration:
- Points to cluster-internal Forgejo (forgejo.forgejo.svc.cluster.local)
- Excludes argocd directory to prevent self-management
- Enables selfHeal for automatic sync of changes
- Disables prune for manual deletion approval
- Deployed to the cluster and verified working

All existing services (Stalwart, Directus, Forgejo, BookStack, Pocket ID,
OpenCloud, Passbolt) remain operational. Some pods restarted due to applying
pending git changes (expected GitOps behavior).

Note: Warning about duplicate opencloud namespace definition in
openldap-deployment.yaml and opencloud-deployment.yaml - does not affect
functionality, can be addressed in follow-up cleanup.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:19:28 +00:00
CTO Agent
b874f3d184 Add memory limits to Argo CD components to prevent OOM incidents 
Implements resource governance for all Argo CD components via kustomization
overlay. This prevents unlimited memory consumption that led to the control
plane resource exhaustion incident (DEV-281).

Resource limits applied:
- application-controller: 512Mi limit, 256Mi request
- repo-server: 512Mi limit, 256Mi request
- redis: 256Mi limit, 128Mi request
- server: 256Mi limit, 128Mi request
- notifications-controller: 128Mi limit, 64Mi request
- applicationset-controller: 256Mi limit, 128Mi request

The limits are based on observed usage patterns with headroom for growth
while preventing runaway memory consumption.

Usage: kubectl apply -k apps/argocd/

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:19:28 +00:00
CTO Agent
a95e638f6b Add Argo CD installation manifests with Pocket ID SSO 
- Downloaded upstream Argo CD install.yaml from stable branch
- Customized for basicstack.de cluster:
  - Disabled dex deployment (using Pocket ID OIDC instead)
  - Added --insecure flag to argocd-server (TLS at Traefik ingress)
  - Configured OIDC integration with auth.basicstack.de
  - Added RBAC policy mapping argo_admins group to admin role
  - Mounted OIDC client credentials from argocd-oidc-secret
- Created Traefik ingress for argo.basicstack.de with cert-manager TLS

Sealed secrets for OIDC and repository credentials already in place.
Ready for deployment per DEV-249 plan.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:19:28 +00:00
CTO Agent
d1d2b77ef2 Add Argo CD sealed secrets for OIDC and repository access 
Created three SealedSecrets for Argo CD integration:
- argocd-oidc-secret: Pocket ID OIDC client credentials
- repo-stack-basicstack-de: SSH deploy key for stack repository
- repo-basicstack-org: SSH deploy key for basicstack.org repository

Repository secrets include argocd.argoproj.io/secret-type label
for automatic Argo CD discovery.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:19:28 +00:00