argo-cd:
  global:
    image:
      tag: "v2.13.8"

  # Single-node homelab VM (8GB RAM / 6 cores, see claude.md) — no dedicated
  # devops node pool here, so the GKE nodeSelector/toleration pair from the
  # fleet's admin cluster doesn't apply. Every component below is trimmed to
  # a single replica with small resource requests to fit the ~700MB total
  # budget claude.md tracks for ArgoCD.

  # SSO deferred per claude.md ("not yet implemented") — Dex stays off until
  # that's picked back up. Revisit this file when it is.
  dex:
    enabled: false

  controller:
    replicas: 1
    resources:
      requests:
        cpu: 200m
        memory: 400Mi
      limits:
        cpu: 500m
        memory: 768Mi

  redis-ha:
    enabled: false
  redis:
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        memory: 128Mi

  repoServer:
    replicas: 1
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: 300m
        memory: 512Mi

  server:
    replicas: 1
    extraArgs:
      - --insecure
    ingress:
      enabled: true
      ingressClassName: contour
      # LAN hostname, matching claude.md's documented access URL. Add the
      # Tailscale nip.io variant (argocd.100.90.248.118.nip.io) the same
      # way Gitea does it if remote access is needed later.
      hostname: "argocd.192.168.1.7.nip.io"
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 200m
        memory: 256Mi

  # Not used by this repo's Applications (plain Application manifests
  # rendered by generic-argo-apps-chart, not the ApplicationSet CRD) and
  # notifications has no configured trigger/service — both off to save RAM.
  applicationSet:
    enabled: false
  notifications:
    enabled: false

  configs:
    cm:
      url: "https://argocd.192.168.1.7.nip.io"
      timeout.reconciliation: 3m
      timeout.reconciliation.jitter: 60s
      # ArgoCD's built-in Ingress health check waits for
      # status.loadBalancer.ingress to be populated — that only happens
      # behind a Service type=LoadBalancer. Contour here is exposed via
      # hostPort (MetalLB is installed but not load-bearing, see
      # claude.md), so nothing ever writes that status field and every
      # Ingress sits "Progressing" forever even though it's actually
      # serving traffic fine. Override: an Ingress existing is enough.
      resource.customizations.health.networking.k8s.io_Ingress: |
        hs = {}
        hs.status = "Healthy"
        hs.message = "Ingress considered healthy on sight — this cluster's Contour has no LoadBalancer status to wait on (hostPort, not MetalLB)."
        return hs
    # No custom RBAC policy: single-user homelab, the initial admin secret
    # (kubectl -n argocd get secret argocd-initial-admin-secret) is enough.
    # The fleet's role:admins / role:backend / GitHub-team policy.csv and
    # real teammate emails from the source cluster are dropped here.
    repositories:
      devops-infra-helm-charts:
        url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git
      devops-infra-argo-config:
        url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-argo-config.git