new approach

README.md

@@ -20,23 +20,19 @@
 ```
 gitops/
 ├── bootstrap/
-│   └── root-app.yaml          # the app-of-apps (only file you apply manually, once)
+│   ├── namespaces.yaml        # cluster namespaces
+│   ├── argocd-install/        # Argo CD install manifests + ingress
+│   └── root-app.yaml          # root Application watching apps/root
 ├── apps/
-│   └── root/
-│       ├── kustomization.yaml # lists every child Application
-│       ├── argocd.yaml        # Argo CD managing itself (dogfood)
-│       ├── notepad.yaml
-│       └── ...
-└── apps/<name>/               # per-app dir
-    ├── kustomization.yaml
-    ├── deployment.yaml
-    ├── service.yaml
-    ├── ingress.yaml
-    └── pvc.yaml
+│   ├── root/
+│   │   ├── kustomization.yaml # points to applicationset.yaml
+│   │   └── applicationset.yaml# auto-discovers apps/*/*.yaml
+│   └── <namespace>/           # e.g., default/, media/, monitoring/
+│       ├── <app-1>.yaml       # all-in-one manifest per app
+│       └── <app-2>.yaml
 ```
 
-`apps/root/kustomization.yaml` is the switchboard — adding a service = adding one
-`Application` entry + one folder.
+To add a new app: simply drop `<app>.yaml` into the appropriate `apps/<namespace>/` folder. The ApplicationSet automatically generates an Argo CD Application for it.
 
 ## 3. Manual bootstrap (run once, by hand)
 
@@ -83,10 +79,7 @@ spec:
       selfHeal: true
 ```
 
-**`apps/root/argocd.yaml`** — Argo CD managing itself (standard dogfood pattern).
-**Each child app** follows the same shape with `path: apps/<name>` and
-`destination.namespace` matching where it runs today (`default` for most of your
-internal apps).
+**`apps/root/applicationset.yaml`** — Uses the Git Files generator to discover any `apps/*/*.yaml` file and automatically generate an Argo CD `Application` pointing directly to that app file within the respective namespace.
 
 ## 5. Ingress (internal-only, per Haven convention)
 

SETUP.md

@@ -1,6 +1,19 @@
 # Initial setup
 ```sh
-kubectl create ns argocd
+# Create namespace
+kubectl apply -f bootstrap/namespaces.yaml
+
+# Install ArgoCD
 kubectl apply -k bootstrap/argocd-install
+
+# Apply root app
 kubectl apply -f bootstrap/root-app.yaml
 ```
+
+## Access ArgoCD
+1. Get admin password
+```sh
+kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d; echo
+```
+
+2. Access ArgoCD and login with `admin` / password from above.

apps/root/applicationset.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: haven-apps
+  namespace: argocd
+spec:
+  generators:
+    - git:
+        repoURL: https://git.ivanch.me/ivanch/haven-ops.git
+        revision: main
+        files:
+          - path: "apps/*/*.yaml"
+  template:
+    metadata:
+      name: "{{path.filenameNormalized}}"
+      namespace: argocd
+      finalizers:
+        - resources-finalizer.argocd.argoproj.io
+    spec:
+      project: default
+      source:
+        repoURL: https://git.ivanch.me/ivanch/haven-ops.git
+        targetRevision: main
+        path: "{{path}}"
+        directory:
+          include: "{{path.filename}}"
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: "{{path[1]}}"
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true

apps/root/kustomization.yaml

@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+
 resources:
-  - notepad.yaml
-  # - argocd.yaml        # enable once Argo CD itself is onboarded (self-managed)
-  # - openwebui.yaml     # future apps: one Application file each, listed here
-  # - paperless.yaml
+  - applicationset.yaml

apps/root/notepad.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: notepad
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://git.ivanch.me/ivanch/haven-ops.git
-    targetRevision: main
-    path: apps/notepad
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

bootstrap/argocd-install/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 namespace: argocd
 
 resources:
+  - https://github.com/argoproj/argo-cd.git/manifests/crds?ref=stable
   - https://github.com/argoproj/argo-cd.git/manifests/cluster-install?ref=stable
   - ingress.yaml
 

bootstrap/namespaces.yaml

@@ -0,0 +1,148 @@
+---
+# ==============================================================================
+# Core / System Namespaces
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-node-lease
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-public
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+---
+# ==============================================================================
+# Infrastructure, Ingress & GitOps
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: docker-ingress
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+  labels:
+    name: external-secrets
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metallb-system
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nfs-provisioner
+  labels:
+    name: nfs-provisioner
+---
+# ==============================================================================
+# Observability & Monitoring
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: alloy
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+---
+# ==============================================================================
+# Storage & Data
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: garage
+  labels:
+    name: garage
+---
+# ==============================================================================
+# Environments & Workloads
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: chacal
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloud
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cronjobs
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: lab
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mindforge
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vpn-session-pods
+  labels:
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged