Add expense-tracker Application

Co-Authored-By: Claude Sonnet 5 <[email protected]>

README.md

@@ -3,7 +3,8 @@
 App-of-Apps Helm chart. Renders `argoproj.io/v1alpha1 Application` resources
 for every entry configured under `applications` in [`values.yaml`](values.yaml),
 including the [`valheim-gitops`](https://git.smokyzone.de/SmokyZone/valheim-gitops)
-stack.
+and [`expense_tracker-gitops`](https://git.smokyzone.de/SmokyZone/expense_tracker-gitops)
+stacks.
 
 Because this repository *is* a Helm chart, it can be registered in ArgoCD as its
 own Application (Helm source), which then manages all child Applications declared
@@ -22,8 +23,8 @@ in `values.yaml`.
    This registers `apps-in-apps` itself as an ArgoCD Application using this
    git repo as a Helm chart source, with automated sync/prune/self-heal.
 3. ArgoCD renders `templates/application.yaml`, which creates one child
-   Application per entry in `applications` (currently: `valheim`, pointing at
+   Application per entry in `applications` (currently: `valheim`, `expense-tracker`,
-   the `valheim-gitops` chart).
+   plus the platform apps).
 
 ## Adding another app
 

values.yaml

@@ -33,6 +33,25 @@ applications:
       syncOptions:
         - CreateNamespace=true
 
+  # Budget / expense tracker: web app + Postgres + ingress (https://budget.smokyzone.de:30444).
+  # Needs its secrets in OpenBao first (secret/expense-tracker/{app,db}) - see the
+  # expense_tracker-gitops README. Until then its pods wait for the ExternalSecrets.
+  - name: expense-tracker
+    enabled: true
+    source:
+      repoURL: https://git.smokyzone.de/SmokyZone/expense_tracker-gitops.git
+      targetRevision: main
+      path: .
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: expense-tracker
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true
+
   # External Secrets Operator - installed straight from its official Helm
   # repo (no git source needed). CRDs are installed by the chart itself.
   - name: external-secrets
@@ -53,12 +72,19 @@ applications:
         selfHeal: true
       syncOptions:
         - CreateNamespace=true
+        # The SecretStore/ClusterSecretStore CRDs embed a very large OpenAPI
+        # schema; a plain `kubectl apply` stores the full manifest in the
+        # `kubectl.kubernetes.io/last-applied-configuration` annotation,
+        # which exceeds Kubernetes' 262144 byte annotation limit and fails
+        # with "metadata.annotations: Too long". Server-side apply avoids
+        # writing that annotation entirely.
+        - ServerSideApply=true
 
   # OpenBao secret management backend + its ClusterSecretStore binding for ESO.
   - name: openbao
     enabled: true
     source:
-      repoURL: https://git.smokyzone.de/SmokyZone/openbao-gitops.git
+      repoURL: https://git.smokyzone.de/SmokyZone/openbao.git
       targetRevision: main
       path: .
     destination:
@@ -70,3 +96,31 @@ applications:
         selfHeal: true
       syncOptions:
         - CreateNamespace=true
+
+  # Stakater Reloader - watches Secrets/ConfigMaps and triggers a rolling restart
+  # of workloads that reference them (e.g. after ESO refreshes a secret from OpenBao).
+  # Opt-in per workload via annotation, e.g. on a Deployment/StatefulSet:
+  #   secret.reloader.stakater.com/reload: "<secret-name>"
+  # or `reloader.stakater.com/auto: "true"` to react to every referenced Secret/ConfigMap.
+  - name: reloader
+    enabled: true
+    source:
+      repoURL: https://stakater.github.io/stakater-charts
+      chart: reloader
+      targetRevision: "2.2.17"
+      helm:
+        values: |
+          reloader:
+            # The default strategy injects an env var into the pod template, which
+            # ArgoCD (selfHeal) would revert as drift. Annotations on the pod template
+            # are extra map keys and are ignored by ArgoCD's diff.
+            reloadStrategy: annotations
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: reloader
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true