initial: homelab-services app-of-apps, ignis service

2026-08-03 00:38:30 +07:00
commit 57dcecedb7
10 changed files with 286 additions and 0 deletions
@@ -0,0 +1,64 @@
+# Homelab Service — Apps
+
+Third bootstrap layer, run after `cluster-bootstrap` and `cluster-platform`.
+Personal/homelab apps (not cluster infra, not shared platform tooling) — first
+one here is [Ignis](https://github.com/Nystik-gh/ignis), a self-hosted
+browser-based Obsidian.
+
+## Architecture
+
+Same app-of-apps pattern as `cluster-platform`:
+
+```
+homelab-app.yaml     ← root Application, applied once by hand (kubectl apply)
+apps/<service>/
+  application.yaml     ArgoCD Application
+  chart/                self-authored Helm chart (no upstream chart to point at)
+```
+
+`homelab-app.yaml` watches `apps/*/application.yaml` (recurse) only.
+
+## Bootstrap
+
+```bash
+kubectl apply -f homelab-app.yaml
+```
+
+## Ignis
+
+- Image: `nobbe/ignis:latest` — no official Helm chart, chart here is
+  self-authored from the docker-compose example in the upstream repo.
+- 3 PVCs on `nfs-delete`: `ignis-vaults` (your actual vault data),
+  `ignis-data` (plugin config/state), `ignis-obsidian-app` (downloaded
+  Obsidian binary, avoids re-download on every restart).
+- Single replica only — app has an in-process file watcher + write coalescer,
+  not built for multiple instances sharing a vault concurrently.
+- `ignis-vaults` PVC has `argocd.argoproj.io/sync-options: Delete=false` — the
+  `nfs-delete` StorageClass has `reclaimPolicy: Delete`, so without this
+  annotation an accidental prune (app removed from git, or `helm uninstall`)
+  would delete your vault data on the NAS. The annotation only protects
+  against ArgoCD prune, not `kubectl delete pvc` by hand.
+- No dedicated health endpoint upstream; probes hit `/api/version` (only
+  documented stable route once the server is up).
+- **No built-in auth** (upstream docs explicitly warn about this). HTTPRoute
+  is exposed at `ignis.fireflylab.local` with no auth in front — same
+  LAN-only tradeoff already accepted for Vault in `cluster-platform`. Add an
+  Envoy Gateway `SecurityPolicy` (basic auth) later if that's not enough.
+
+### Migrating your existing vault
+
+The `ignis-vaults` PVC is backed by `nfs-delete` (NFS subdir provisioner) —
+data physically lives on the NAS, not on any worker node. After the PVC first
+binds, a subdir appears under the NAS export
+(`<nfs path>/ignis-<pvc-name>-<uid>`); mount that export directly (NFS/SMB
+client) or `kubectl cp` your existing vault folder into the running pod's
+`/vaults` mount.
+
+### First login / verification
+
+```bash
+kubectl get pods -n ignis
+kubectl logs -n ignis deploy/ignis   # first boot downloads Obsidian, 1-2 min
+```
+
+Visit `http://ignis.fireflylab.local` once the pod is Ready.