initial: homelab-services app-of-apps, ignis service

apps/ignis/chart/templates/deployment.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+    type: Recreate  # RWO volumes, single instance — never run 2 pods at once
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: ignis
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.service.port }}
+          env:
+            {{- range $k, $v := .Values.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: vaults
+              mountPath: /vaults
+            - name: data
+              mountPath: /app/data
+            - name: obsidian-app
+              mountPath: /app/obsidian-app
+          # No dedicated health endpoint documented upstream; /api/version
+          # is the only stable route that responds once the server is up.
+          readinessProbe:
+            httpGet:
+              path: /api/version
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /api/version
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: 90  # first boot downloads Obsidian, can take 1-2min
+            periodSeconds: 20
+      volumes:
+        - name: vaults
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-vaults
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-data
+        - name: obsidian-app
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-obsidian-app

apps/ignis/chart/templates/httproute.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.httpRoute.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}
+  # No built-in auth in Ignis itself — LAN-only exposure, same tradeoff
+  # already accepted for Vault in cluster-platform.
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - {{ .Values.httpRoute.hostname | quote }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ .Release.Name }}
+          port: {{ .Values.service.port }}
+{{- end }}

apps/ignis/chart/templates/pvc.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-vaults
+  annotations:
+    # nfs-delete StorageClass = reclaimPolicy Delete. This PVC holds your real
+    # vault data — refuse to let ArgoCD prune it even if removed from git.
+    # You still need to delete it by hand if you ever really want to.
+    argocd.argoproj.io/sync-options: Delete=false
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.persistence.vaults.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.vaults.size }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.persistence.data.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.data.size }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-obsidian-app
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.persistence.obsidianApp.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.obsidianApp.size }}

apps/ignis/chart/templates/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  selector:
+    app: {{ .Release.Name }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.port }}