# Homelab Service — Apps

Third bootstrap layer, run after `cluster-bootstrap` and `cluster-platform`.
Personal/homelab apps (not cluster infra, not shared platform tooling) — first
one here is [Ignis](https://github.com/Nystik-gh/ignis), a self-hosted
browser-based Obsidian.

## Architecture

Same app-of-apps pattern as `cluster-platform`:

```
homelab-app.yaml     ← root Application, applied once by hand (kubectl apply)
apps/<service>/
  application.yaml     ArgoCD Application
  chart/                self-authored Helm chart (no upstream chart to point at)
```

`homelab-app.yaml` watches `apps/*/application.yaml` (recurse) only.

## Bootstrap

```bash
kubectl apply -f homelab-app.yaml
```

## Ignis

- Image: `nobbe/ignis:latest` — no official Helm chart, chart here is
  self-authored from the docker-compose example in the upstream repo.
- 3 PVCs on `nfs-delete`: `ignis-vaults` (your actual vault data),
  `ignis-data` (plugin config/state), `ignis-obsidian-app` (downloaded
  Obsidian binary, avoids re-download on every restart).
- Single replica only — app has an in-process file watcher + write coalescer,
  not built for multiple instances sharing a vault concurrently.
- `ignis-vaults` PVC has `argocd.argoproj.io/sync-options: Delete=false` — the
  `nfs-delete` StorageClass has `reclaimPolicy: Delete`, so without this
  annotation an accidental prune (app removed from git, or `helm uninstall`)
  would delete your vault data on the NAS. The annotation only protects
  against ArgoCD prune, not `kubectl delete pvc` by hand.
- No dedicated health endpoint upstream; probes hit `/api/version` (only
  documented stable route once the server is up).
- **No built-in auth** (upstream docs explicitly warn about this). HTTPRoute
  is exposed at `ignis.fireflylab.local` with no auth in front — same
  LAN-only tradeoff already accepted for Vault in `cluster-platform`. Add an
  Envoy Gateway `SecurityPolicy` (basic auth) later if that's not enough.

### Migrating your existing vault

The `ignis-vaults` PVC is backed by `nfs-delete` (NFS subdir provisioner) —
data physically lives on the NAS, not on any worker node. After the PVC first
binds, a subdir appears under the NAS export
(`<nfs path>/ignis-<pvc-name>-<uid>`); mount that export directly (NFS/SMB
client) or `kubectl cp` your existing vault folder into the running pod's
`/vaults` mount.

### First login / verification

```bash
kubectl get pods -n ignis
kubectl logs -n ignis deploy/ignis   # first boot downloads Obsidian, 1-2 min
```

Visit `http://ignis.fireflylab.local` once the pod is Ready.