initial: homelab-services app-of-apps, ignis service

apps/ignis/application.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ignis
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.fireflylab.cc/duynguyen/homelab-services.git
+    targetRevision: main
+    path: apps/ignis/chart
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ignis
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/ignis/chart/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: ignis
+description: Self-hosted browser-based Obsidian (https://github.com/Nystik-gh/ignis)
+type: application
+version: 0.1.0
+appVersion: "latest"

apps/ignis/chart/templates/deployment.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+    type: Recreate  # RWO volumes, single instance — never run 2 pods at once
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: ignis
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.service.port }}
+          env:
+            {{- range $k, $v := .Values.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: vaults
+              mountPath: /vaults
+            - name: data
+              mountPath: /app/data
+            - name: obsidian-app
+              mountPath: /app/obsidian-app
+          # No dedicated health endpoint documented upstream; /api/version
+          # is the only stable route that responds once the server is up.
+          readinessProbe:
+            httpGet:
+              path: /api/version
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /api/version
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: 90  # first boot downloads Obsidian, can take 1-2min
+            periodSeconds: 20
+      volumes:
+        - name: vaults
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-vaults
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-data
+        - name: obsidian-app
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-obsidian-app

apps/ignis/chart/templates/httproute.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.httpRoute.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}
+  # No built-in auth in Ignis itself — LAN-only exposure, same tradeoff
+  # already accepted for Vault in cluster-platform.
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - {{ .Values.httpRoute.hostname | quote }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ .Release.Name }}
+          port: {{ .Values.service.port }}
+{{- end }}

apps/ignis/chart/templates/pvc.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-vaults
+  annotations:
+    # nfs-delete StorageClass = reclaimPolicy Delete. This PVC holds your real
+    # vault data — refuse to let ArgoCD prune it even if removed from git.
+    # You still need to delete it by hand if you ever really want to.
+    argocd.argoproj.io/sync-options: Delete=false
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.persistence.vaults.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.vaults.size }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.persistence.data.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.data.size }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-obsidian-app
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.persistence.obsidianApp.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.obsidianApp.size }}

apps/ignis/chart/templates/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  selector:
+    app: {{ .Release.Name }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.port }}

apps/ignis/chart/values.yaml

@@ -0,0 +1,39 @@
+image:
+  repository: nobbe/ignis
+  tag: latest
+  pullPolicy: IfNotPresent
+
+# Ignis is a single-process app (in-memory file watcher + write coalescer,
+# no clustering) — do not scale beyond 1 replica, RWO storage is enough.
+replicaCount: 1
+
+service:
+  port: 8080
+
+env:
+  PUID: "1000"
+  PGID: "1000"
+  # WRITE_COALESCE_MS: "500"   # uncomment if NFS write latency causes issues
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    memory: 1Gi
+
+persistence:
+  # your existing Obsidian vault goes here after PVC binds (see repo NFS path)
+  vaults:
+    storageClass: nfs-delete
+    size: 20Gi
+  data:
+    storageClass: nfs-delete
+    size: 1Gi
+  obsidianApp:
+    storageClass: nfs-delete
+    size: 2Gi
+
+httpRoute:
+  enabled: true
+  hostname: ignis.fireflylab.local