65 lines
2.5 KiB
Markdown
65 lines
2.5 KiB
Markdown
# Homelab Service — Apps
|
|
|
|
Third bootstrap layer, run after `cluster-bootstrap` and `cluster-platform`.
|
|
Personal/homelab apps (not cluster infra, not shared platform tooling) — first
|
|
one here is [Ignis](https://github.com/Nystik-gh/ignis), a self-hosted
|
|
browser-based Obsidian.
|
|
|
|
## Architecture
|
|
|
|
Same app-of-apps pattern as `cluster-platform`:
|
|
|
|
```
|
|
homelab-app.yaml ← root Application, applied once by hand (kubectl apply)
|
|
apps/<service>/
|
|
application.yaml ArgoCD Application
|
|
chart/ self-authored Helm chart (no upstream chart to point at)
|
|
```
|
|
|
|
`homelab-app.yaml` watches `apps/*/application.yaml` (recurse) only.
|
|
|
|
## Bootstrap
|
|
|
|
```bash
|
|
kubectl apply -f homelab-app.yaml
|
|
```
|
|
|
|
## Ignis
|
|
|
|
- Image: `nobbe/ignis:latest` — no official Helm chart, chart here is
|
|
self-authored from the docker-compose example in the upstream repo.
|
|
- 3 PVCs on `nfs-delete`: `ignis-vaults` (your actual vault data),
|
|
`ignis-data` (plugin config/state), `ignis-obsidian-app` (downloaded
|
|
Obsidian binary, avoids re-download on every restart).
|
|
- Single replica only — app has an in-process file watcher + write coalescer,
|
|
not built for multiple instances sharing a vault concurrently.
|
|
- `ignis-vaults` PVC has `argocd.argoproj.io/sync-options: Delete=false` — the
|
|
`nfs-delete` StorageClass has `reclaimPolicy: Delete`, so without this
|
|
annotation an accidental prune (app removed from git, or `helm uninstall`)
|
|
would delete your vault data on the NAS. The annotation only protects
|
|
against ArgoCD prune, not `kubectl delete pvc` by hand.
|
|
- No dedicated health endpoint upstream; probes hit `/api/version` (only
|
|
documented stable route once the server is up).
|
|
- **No built-in auth** (upstream docs explicitly warn about this). HTTPRoute
|
|
is exposed at `ignis.fireflylab.local` with no auth in front — same
|
|
LAN-only tradeoff already accepted for Vault in `cluster-platform`. Add an
|
|
Envoy Gateway `SecurityPolicy` (basic auth) later if that's not enough.
|
|
|
|
### Migrating your existing vault
|
|
|
|
The `ignis-vaults` PVC is backed by `nfs-delete` (NFS subdir provisioner) —
|
|
data physically lives on the NAS, not on any worker node. After the PVC first
|
|
binds, a subdir appears under the NAS export
|
|
(`<nfs path>/ignis-<pvc-name>-<uid>`); mount that export directly (NFS/SMB
|
|
client) or `kubectl cp` your existing vault folder into the running pod's
|
|
`/vaults` mount.
|
|
|
|
### First login / verification
|
|
|
|
```bash
|
|
kubectl get pods -n ignis
|
|
kubectl logs -n ignis deploy/ignis # first boot downloads Obsidian, 1-2 min
|
|
```
|
|
|
|
Visit `http://ignis.fireflylab.local` once the pod is Ready.
|