apps-in-apps/values.yaml

## Default values for the apps-in-apps chart (App-of-Apps pattern).

argocd:
  # Namespace where ArgoCD (and thus the Application CRs) live.
  namespace: argocd
  # AppProject the generated Applications belong to.
  project: default

# List of child ArgoCD Applications this chart renders.
# Each entry maps 1:1 to an `argoproj.io/v1alpha1 Application`.
applications:
  - name: valheim
    enabled: true
    source:
      repoURL: https://git.smokyzone.de/SmokyZone/valheim-gitops.git
      targetRevision: main
      path: .
      helm:
        # Extra --set style values merged into the valheim-gitops chart.
        # Keep secrets out of here - override via a sealed/external secret
        # or ArgoCD parameter overrides instead.
        parameters: []
        # valueFiles:
        #   - values.yaml
    destination:
      # Empty server means "the cluster ArgoCD itself runs in".
      server: https://kubernetes.default.svc
      namespace: valheim
    syncPolicy:
      automated:
        prune: true
        selfHeal: true
      syncOptions:
        - CreateNamespace=true

  # Budget / expense tracker: web app + Postgres + ingress (https://budget.smokyzone.de:30444).
  # Needs its secrets in OpenBao first (secret/expense-tracker/{app,db}) - see the
  # expense_tracker-gitops README. Until then its pods wait for the ExternalSecrets.
  - name: expense-tracker
    enabled: true
    source:
      repoURL: https://git.smokyzone.de/SmokyZone/expense_tracker-gitops.git
      targetRevision: main
      path: .
    destination:
      server: https://kubernetes.default.svc
      namespace: expense-tracker
    syncPolicy:
      automated:
        prune: true
        selfHeal: true
      syncOptions:
        - CreateNamespace=true

  # External Secrets Operator - installed straight from its official Helm
  # repo (no git source needed). CRDs are installed by the chart itself.
  - name: external-secrets
    enabled: true
    source:
      repoURL: https://charts.external-secrets.io
      chart: external-secrets
      targetRevision: "2.10.0"
      helm:
        values: |
          installCRDs: true
    destination:
      server: https://kubernetes.default.svc
      namespace: external-secrets
    syncPolicy:
      automated:
        prune: true
        selfHeal: true
      syncOptions:
        - CreateNamespace=true
        # The SecretStore/ClusterSecretStore CRDs embed a very large OpenAPI
        # schema; a plain `kubectl apply` stores the full manifest in the
        # `kubectl.kubernetes.io/last-applied-configuration` annotation,
        # which exceeds Kubernetes' 262144 byte annotation limit and fails
        # with "metadata.annotations: Too long". Server-side apply avoids
        # writing that annotation entirely.
        - ServerSideApply=true

  # OpenBao secret management backend + its ClusterSecretStore binding for ESO.
  - name: openbao
    enabled: true
    source:
      repoURL: https://git.smokyzone.de/SmokyZone/openbao.git
      targetRevision: main
      path: .
    destination:
      server: https://kubernetes.default.svc
      namespace: openbao
    syncPolicy:
      automated:
        prune: true
        selfHeal: true
      syncOptions:
        - CreateNamespace=true

  # Stakater Reloader - watches Secrets/ConfigMaps and triggers a rolling restart
  # of workloads that reference them (e.g. after ESO refreshes a secret from OpenBao).
  # Opt-in per workload via annotation, e.g. on a Deployment/StatefulSet:
  #   secret.reloader.stakater.com/reload: "<secret-name>"
  # or `reloader.stakater.com/auto: "true"` to react to every referenced Secret/ConfigMap.
  - name: reloader
    enabled: true
    source:
      repoURL: https://stakater.github.io/stakater-charts
      chart: reloader
      targetRevision: "2.2.17"
      helm:
        values: |
          reloader:
            # The default strategy injects an env var into the pod template, which
            # ArgoCD (selfHeal) would revert as drift. Annotations on the pod template
            # are extra map keys and are ignored by ArgoCD's diff.
            reloadStrategy: annotations
    destination:
      server: https://kubernetes.default.svc
      namespace: reloader
    syncPolicy:
      automated:
        prune: true
        selfHeal: true
      syncOptions:
        - CreateNamespace=true