Initial commit

.gitignore

@@ -0,0 +1,14 @@
+# IDE
+.vscode/
+.idea/
+
+# OS
+.DS_Store
+
+# Temporary files
+*.tmp
+*.bak
+*.swp
+
+# Optional if you don't want rendered manifests in Git
+# rendered/

charts/argocd/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: argocd-wrapper
+description: Wrapper chart for Argo CD config
+type: application
+version: 0.1.0
+appVersion: "1.0.0"

charts/argocd/templates/httproute.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Values.route.name }}
+  namespace: {{ .Values.route.namespace }}
+spec:
+  parentRefs:
+    - name: {{ .Values.route.gatewayName }}
+      namespace: {{ .Values.route.gatewayNamespace }}
+  hostnames:
+{{- range .Values.route.hostnames }}
+    - {{ . | quote }}
+{{- end }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: {{ .Values.argocd.basePath | quote }}
+      backendRefs:
+        - name: {{ .Values.route.serviceName }}
+          port: {{ .Values.route.servicePort }}

charts/argocd/upstream-values.yaml

@@ -0,0 +1,38 @@
+configs:
+  cm:
+    url: http://www.symcrest.com/internal/ops/argocd
+
+  params:
+    server.insecure: true
+    server.basehref: /internal/ops/argocd
+    server.rootpath: /internal/ops/argocd
+
+controller:
+  nodeSelector:
+    workload: app
+
+server:
+  nodeSelector:
+    workload: app
+  service:
+    type: ClusterIP
+
+repoServer:
+  nodeSelector:
+    workload: app
+
+dex:
+  nodeSelector:
+    workload: app
+
+redis:
+  nodeSelector:
+    workload: app
+
+notifications:
+  nodeSelector:
+    workload: app
+
+applicationSet:
+  nodeSelector:
+    workload: app

charts/argocd/values.yaml

@@ -0,0 +1,14 @@
+argocd:
+  url: http://www.symcrest.com/internal/ops/argocd
+  basePath: /internal/ops/argocd
+
+route:
+  name: argocd
+  namespace: argocd
+  gatewayName: public-gateway
+  gatewayNamespace: apps
+  hostnames:
+    - symcrest.com
+    - www.symcrest.com
+  serviceName: argocd-server
+  servicePort: 80

charts/longhorn/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: longhorn-wrapper
+description: Wrapper chart for Longhorn
+type: application
+version: 0.1.0
+appVersion: "1.0.0"

charts/longhorn/templates/httproute.yaml

@@ -0,0 +1,39 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Values.route.name }}
+  namespace: {{ .Values.route.namespace }}
+spec:
+  parentRefs:
+    - name: {{ .Values.route.gatewayName }}
+      namespace: {{ .Values.route.gatewayNamespace }}
+  hostnames:
+{{- range .Values.route.hostnames }}
+    - {{ . | quote }}
+{{- end }}
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: {{ .Values.longhorn.basePath | quote }}
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: {{ printf "%s/" .Values.longhorn.basePath | quote }}
+            statusCode: 301
+
+    - matches:
+        - path:
+            type: PathPrefix
+            value: {{ printf "%s/" .Values.longhorn.basePath | quote }}
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplacePrefixMatch
+              replacePrefixMatch: {{ .Values.longhorn.rewriteTo | quote }}
+      backendRefs:
+        - name: {{ .Values.route.serviceName }}
+          port: {{ .Values.route.servicePort }}

charts/longhorn/upstream-values.yaml

@@ -0,0 +1,12 @@
+defaultSettings:
+  defaultDataPath: /var/lib/longhorn
+  defaultReplicaCount: 2
+
+persistence:
+  defaultClassReplicaCount: 2
+
+longhornUI:
+  replicas: 1
+
+ingress:
+  enabled: false

charts/longhorn/values.yaml

@@ -0,0 +1,15 @@
+longhorn:
+  url: http://www.symcrest.com/internal/ops/longhorn
+  basePath: /internal/ops/longhorn
+  rewriteTo: /
+
+route:
+  name: longhorn
+  namespace: longhorn-system
+  gatewayName: public-gateway
+  gatewayNamespace: apps
+  hostnames:
+    - symcrest.com
+    - www.symcrest.com
+  serviceName: longhorn-frontend
+  servicePort: 80

charts/pgadmin/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: pgadmin
+description: Symcrest pgAdmin chart
+type: application
+version: 0.1.0
+appVersion: "9.15"

charts/pgadmin/templates/deployment.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgadmin
+  namespace: {{ .Values.namespace }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pgadmin
+  template:
+    metadata:
+      labels:
+        app: pgadmin
+    spec:
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+      securityContext:
+        fsGroup: 5050
+        fsGroupChangePolicy: "OnRootMismatch"
+      containers:
+        - name: pgadmin
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          securityContext:
+            runAsUser: 5050
+            runAsGroup: 5050
+          ports:
+            - containerPort: 80
+              name: http
+          envFrom:
+            - secretRef:
+                name: pgadmin-secret
+          env:
+            - name: SCRIPT_NAME
+              value: {{ .Values.route.basePath | quote }}
+          volumeMounts:
+            - name: pgadmin-data
+              mountPath: /var/lib/pgadmin
+      volumes:
+        - name: pgadmin-data
+          persistentVolumeClaim:
+            claimName: pgadmin-data

charts/pgadmin/templates/httproute.yaml

@@ -0,0 +1,33 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Values.route.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  parentRefs:
+    - name: {{ .Values.route.gatewayName }}
+      namespace: {{ .Values.route.gatewayNamespace }}
+  hostnames:
+{{- range .Values.route.hostnames }}
+    - {{ . | quote }}
+{{- end }}
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: {{ .Values.route.basePath | quote }}
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: {{ printf "%s/" .Values.route.basePath | quote }}
+            statusCode: 301
+
+    - matches:
+        - path:
+            type: PathPrefix
+            value: {{ printf "%s/" .Values.route.basePath | quote }}
+      backendRefs:
+        - name: {{ .Values.route.serviceName }}
+          port: {{ .Values.route.servicePort }}

charts/pgadmin/templates/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pgadmin-data
+  namespace: {{ .Values.namespace }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.storage.className | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.storage.size | quote }}

charts/pgadmin/templates/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pgadmin
+  namespace: {{ .Values.namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: pgadmin
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

charts/pgadmin/values.yaml

@@ -0,0 +1,27 @@
+namespace: pgadmin
+
+image:
+  repository: dpage/pgadmin4
+  tag: "9.15"
+
+auth:
+  email: arvind.prabhakar@symcrest.com
+  secret: postgres-secret
+
+storage:
+  className: longhorn
+  size: 5Gi
+
+nodeSelector:
+  workload: app
+
+route:
+  name: pgadmin
+  gatewayName: public-gateway
+  gatewayNamespace: apps
+  hostnames:
+    - symcrest.com
+    - www.symcrest.com
+  basePath: /internal/dev/pgadmin
+  serviceName: pgadmin
+  servicePort: 80

charts/postgres/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: postgres
+description: Chart for PostgreSQL using official Postgres image
+type: application
+version: 0.1.0
+appVersion: "18.4"

charts/postgres/templates/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: {{ .Values.namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432

charts/postgres/templates/statefulset.yaml

@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: {{ .Values.namespace }}
+spec:
+  serviceName: postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+      containers:
+        - name: postgres
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          ports:
+            - containerPort: 5432
+              name: postgres
+          envFrom:
+            - secretRef:
+                name: postgres-secret
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: {{ .Values.storage.className | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.storage.size | quote }}

charts/postgres/values.yaml

@@ -0,0 +1,17 @@
+namespace: database
+
+image:
+  repository: postgres
+  tag: "18.4"
+
+auth:
+  database: symcrest
+  username: admin
+  secret: postgres-secret
+
+storage:
+  className: longhorn
+  size: 20Gi
+
+nodeSelector:
+  workload: app

infrastructure/namespaces/core-namespaces.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: apps
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn-system
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: forgejo
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: plane

infrastructure/namespaces/data-namespaces.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: database
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: pgadmin
+

infrastructure/storage/test-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: longhorn-test-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi

rendered/argocd/argocd.yaml

@@ -0,0 +1,22 @@
+---
+# Source: argocd-wrapper/templates/httproute.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  parentRefs:
+    - name: public-gateway
+      namespace: apps
+  hostnames:
+    - "symcrest.com"
+    - "www.symcrest.com"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: "/internal/ops/argocd"
+      backendRefs:
+        - name: argocd-server
+          port: 80

rendered/longhorn/longhorn.yaml

@@ -0,0 +1,40 @@
+---
+# Source: longhorn-wrapper/templates/httproute.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  parentRefs:
+    - name: public-gateway
+      namespace: apps
+  hostnames:
+    - "symcrest.com"
+    - "www.symcrest.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: "/internal/ops/longhorn"
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: "/internal/ops/longhorn/"
+            statusCode: 301
+
+    - matches:
+        - path:
+            type: PathPrefix
+            value: "/internal/ops/longhorn/"
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplacePrefixMatch
+              replacePrefixMatch: "/"
+      backendRefs:
+        - name: longhorn-frontend
+          port: 80

rendered/pgadmin/pgadmin.yaml

@@ -0,0 +1,107 @@
+---
+# Source: pgadmin/templates/pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pgadmin-data
+  namespace: pgadmin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: "longhorn"
+  resources:
+    requests:
+      storage: "5Gi"
+---
+# Source: pgadmin/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: pgadmin
+  namespace: pgadmin
+spec:
+  type: ClusterIP
+  selector:
+    app: pgadmin
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+---
+# Source: pgadmin/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgadmin
+  namespace: pgadmin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pgadmin
+  template:
+    metadata:
+      labels:
+        app: pgadmin
+    spec:
+      nodeSelector:
+        workload: app
+      securityContext:
+        fsGroup: 5050
+        fsGroupChangePolicy: "OnRootMismatch"
+      containers:
+        - name: pgadmin
+          image: "dpage/pgadmin4:9.15"
+          securityContext:
+            runAsUser: 5050
+            runAsGroup: 5050
+          ports:
+            - containerPort: 80
+              name: http
+          envFrom:
+            - secretRef:
+                name: pgadmin-secret
+          env:
+            - name: SCRIPT_NAME
+              value: "/internal/dev/pgadmin"
+          volumeMounts:
+            - name: pgadmin-data
+              mountPath: /var/lib/pgadmin
+      volumes:
+        - name: pgadmin-data
+          persistentVolumeClaim:
+            claimName: pgadmin-data
+---
+# Source: pgadmin/templates/httproute.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: pgadmin
+  namespace: pgadmin
+spec:
+  parentRefs:
+    - name: public-gateway
+      namespace: apps
+  hostnames:
+    - "symcrest.com"
+    - "www.symcrest.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: "/internal/dev/pgadmin"
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: "/internal/dev/pgadmin/"
+            statusCode: 301
+
+    - matches:
+        - path:
+            type: PathPrefix
+            value: "/internal/dev/pgadmin/"
+      backendRefs:
+        - name: pgadmin
+          port: 80

rendered/postgres/postgres.yaml

@@ -0,0 +1,72 @@
+---
+# Source: postgres/templates/secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-secret
+  namespace: database
+type: Opaque
+stringData:
+  POSTGRES_DB: "symcrest"
+  POSTGRES_USER: "admin"
+  POSTGRES_PASSWORD: "TempPass123"
+---
+# Source: postgres/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: database
+spec:
+  type: ClusterIP
+  selector:
+    app: postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+---
+# Source: postgres/templates/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: database
+spec:
+  serviceName: postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      nodeSelector:
+        workload: app
+      containers:
+        - name: postgres
+          image: "postgres:18.4"
+          ports:
+            - containerPort: 5432
+              name: postgres
+          envFrom:
+            - secretRef:
+                name: postgres-secret
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: "longhorn"
+        resources:
+          requests:
+            storage: "20Gi"