adding new git-ops structure

bootstrap/address-pool.yaml

@@ -0,0 +1,22 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.15.200/32 # reserved for DNS 1
+    - 192.168.15.202/32 # reserved for wg-easy
+    - 192.168.15.203/32 # reserved for k3s ingress
+    - 192.168.20.200/32 # reserved for DNS 1
+    # - 192.168.20.201 is reserved for DNS 2
+    - 192.168.20.202-192.168.20.220
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: default-advertisement
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - default-pool

bootstrap/argocd-install/argocd-api-user.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  accounts.api: apiKey
+  accounts.api.enabled: "true"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    g, api, role:readonly

bootstrap/argocd-install/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  rules:
+    - host: argocd.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argocd-server
+                port:
+                  number: 80

bootstrap/argocd-install/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: argocd
+
+resources:
+  - https://github.com/argoproj/argo-cd.git/manifests/cluster-install?ref=stable
+  - ingress.yaml
+
+patches:
+  - path: server-insecure-patch.yaml
+  - path: argocd-api-user.yaml

bootstrap/argocd-install/server-insecure-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  server.insecure: "true"

bootstrap/namespaces.yaml

@@ -0,0 +1,141 @@
+---
+# ==============================================================================
+# Core / System Namespaces
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-node-lease
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-public
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+---
+# ==============================================================================
+# Infrastructure, Ingress & GitOps
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: docker-ingress
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+  labels:
+    name: external-secrets
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metallb-system
+---
+# ==============================================================================
+# Observability & Monitoring
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: alloy
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+---
+# ==============================================================================
+# Storage & Data
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: garage
+  labels:
+    name: garage
+---
+# ==============================================================================
+# Environments & Workloads
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: chacal
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloud
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cronjobs
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: lab
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mindforge
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vpn-session-pods
+  labels:
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged

bootstrap/root-app.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: root
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.ivanch.me/ivanch/haven.git
+    targetRevision: main
+    path: apps/root
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

bootstrap/secretstores.yaml

@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-login }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result: { jsonPath: "$.data.login.{{ .remoteRef.property }}" }
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-fields }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        {
+          jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value',
+        }