argo-cd:
  global:
    image:
      tag: "v2.13.8"

  # Single-node homelab VM (8GB RAM / 6 cores, see claude.md) — no dedicated
  # devops node pool here, so the GKE nodeSelector/toleration pair from the
  # fleet's admin cluster doesn't apply. Every component below is trimmed to
  # a single replica with small resource requests to fit the ~700MB total
  # budget claude.md tracks for ArgoCD.

  # SSO deferred per claude.md ("not yet implemented") — Dex stays off until
  # that's picked back up. Revisit this file when it is.
  dex:
    enabled: false

  controller:
    replicas: 1
    resources:
      requests:
        cpu: 200m
        memory: 400Mi
      limits:
        cpu: 500m
        memory: 768Mi

  redis-ha:
    enabled: false
  redis:
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        memory: 128Mi

  repoServer:
    replicas: 1
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: 300m
        memory: 512Mi

  server:
    replicas: 1
    extraArgs:
      - --insecure
    ingress:
      enabled: true
      ingressClassName: contour
      hostname: "argocd.192.168.1.7.nip.io"
      # Tailscale nip.io variant, same dual-host pattern as Gitea — chart
      # supports this natively via extraHosts (confirmed against the real
      # values.yaml, not assumed).
      extraHosts:
        - name: "argocd.100.90.248.118.nip.io"
          path: /
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 200m
        memory: 256Mi

  # Not used by this repo's Applications (plain Application manifests
  # rendered by generic-argo-apps-chart, not the ApplicationSet CRD) and
  # notifications has no configured trigger/service — both off to save RAM.
  applicationSet:
    enabled: false
  notifications:
    enabled: false

  configs:
    cm:
      url: "https://argocd.192.168.1.7.nip.io"
      timeout.reconciliation: 3m
      timeout.reconciliation.jitter: 60s
      # ArgoCD's built-in Ingress health check waits for
      # status.loadBalancer.ingress to be populated — that only happens
      # behind a Service type=LoadBalancer. Contour here is exposed via
      # hostPort (MetalLB is installed but not load-bearing, see
      # claude.md), so nothing ever writes that status field and every
      # Ingress sits "Progressing" forever even though it's actually
      # serving traffic fine. Override: an Ingress existing is enough.
      resource.customizations.health.networking.k8s.io_Ingress: |
        hs = {}
        hs.status = "Healthy"
        hs.message = "Ingress considered healthy on sight — this cluster's Contour has no LoadBalancer status to wait on (hostPort, not MetalLB)."
        return hs
      # Scoped account for Jenkins to trigger a sync as the last step of the
      # CI/CD pipeline — devops-lib's real deployArgoCD.groovy always closes
      # its 4-step ceremony with `argocd app sync --hard-refresh`; without
      # this, our pipeline stops at the tag-bump commit and a human has to
      # remember to click Sync. Uses apiKey auth (token-based), not the
      # admin account — same least-privilege pattern as Harbor's robot
      # account. Token itself is generated via CLI (not declarative — see
      # bootstrap note in devops-lib's syncArgoApp.groovy) and stored in
      # Vault like every other credential here.
      accounts.jenkins-ci: apiKey
      accounts.jenkins-ci.enabled: "true"
    # No custom RBAC policy beyond the jenkins-ci account below: single-user
    # homelab, the initial admin secret (kubectl -n argocd get secret
    # argocd-initial-admin-secret) is enough for you. The fleet's
    # role:admins / role:backend / GitHub-team policy.csv and real teammate
    # emails from the source cluster are dropped here.
    rbac:
      # Scoped to the whole webapp project, not one app name — this is
      # exactly what that AppProject exists for (projects/webapp.yaml in
      # devops-argo-config). Any future app onboarded into it (project:
      # webapp in its Application manifest) is automatically covered by
      # jenkins-ci's sync/get access with zero RBAC changes needed here.
      # Platform-level apps (argocd, gitea, vault, contour,
      # external-secrets, jenkins, harbor) stay on the default project,
      # untouched by this policy.
      policy.csv: |
        p, jenkins-ci, applications, sync, webapp/*, allow
        p, jenkins-ci, applications, get, webapp/*, allow
    repositories:
      devops-infra-helm-charts:
        url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git
      devops-infra-argo-config:
        url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-argo-config.git