add git ignore

.env.example

@@ -0,0 +1,2 @@
+# Generate with: htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
+ARGOCD_ADMIN_PASSWORD_HASH=

.gitignore

@@ -0,0 +1,6 @@
+.env
+
+# OS/editor
+.DS_Store
+*.swp
+CLAUDE.md

README.md

@@ -45,35 +45,27 @@ helm version
 
 ---
 
-## Phase 2 — Fill in NFS details
+## Phase 2 — Set credentials
 
-Edit `manifests/nfs-provisioner/values.yaml` before pushing — replace the two placeholders:
+Install tools (one-time):
 
 ```bash
-git clone https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+sudo dnf install -y httpd-tools gettext
 ```
 
+Copy and fill in `.env`:
+
 ```bash
-cd cluster-bootstrap
+cp .env.example .env
 ```
 
-Open `manifests/nfs-provisioner/values.yaml` and set:
-- `nfs.server` — xpen NAS IP address
-- `nfs.path` — NFS export path (e.g. `/volume1/k8s`)
-
-Then commit and push:
+Generate bcrypt hash and set it in `.env`:
 
 ```bash
-git add manifests/nfs-provisioner/values.yaml
+htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
 ```
 
-```bash
-git commit -m "set nfs server and path"
-```
-
-```bash
-git push origin main
-```
+`.env` is gitignored — never commit it.
 
 ---
 
@@ -89,10 +81,14 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD:
+Install ArgoCD (`envsubst` fills `$ARGOCD_ADMIN_PASSWORD_HASH` from `.env` before helm reads the values):
 
 ```bash
-helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
+source .env
+```
+
+```bash
+envsubst < manifests/argocd/values.yaml | helm install argocd argo/argo-cd -n argocd --create-namespace -f -
 ```
 
 Wait for ArgoCD to be ready:
@@ -101,19 +97,30 @@ Wait for ArgoCD to be ready:
 kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=120s
 ```
 
-Get initial admin password:
-
-```bash
-kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath='{.data.password}' | base64 -d
-```
-
 Port-forward to access UI (MetalLB + Envoy not running yet):
 
 ```bash
 kubectl port-forward svc/argocd-server -n argocd 8080:443
 ```
 
-Open `https://localhost:8080` — login with `admin` and the password above.
+Open `https://localhost:8080` — login with `admin` and the password you chose.
+
+### 3.1 Bake the hash into values.yaml for self-management
+
+ArgoCD won't run `envsubst` when it self-manages — replace the placeholder with the real hash so future syncs work:
+
+```bash
+source .env
+sed -i "s|\$ARGOCD_ADMIN_PASSWORD_HASH|$ARGOCD_ADMIN_PASSWORD_HASH|" manifests/argocd/values.yaml
+```
+
+```bash
+git add manifests/argocd/values.yaml && git commit -m "set argocd admin password hash"
+```
+
+```bash
+git push origin main
+```
 
 ---
 

bootstrap/apps/argocd.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  project: default
+  sources:
+    - repoURL: https://argoproj.github.io/argo-helm
+      chart: argo-cd
+      targetRevision: "7.8.26"
+      helm:
+        valueFiles:
+          - $values/manifests/argocd/values.yaml
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

manifests/argocd/values.yaml

@@ -18,6 +18,15 @@ global:
 configs:
   params:
     server.insecure: true   # TLS terminated at Envoy Gateway
+  secret:
+    argocdServerAdminPassword: "$ARGOCD_ADMIN_PASSWORD_HASH"
+    argocdServerAdminPasswordMtime: "2025-01-01T00:00:00Z"
 
 server:
   replicas: 1
+  httproute:
+    enabled: true
+    parentRefs:
+      - name: envoy-gateway
+        namespace: gateway-system
+        sectionName: http