# Argo CD — noble lab (GitOps)
#
# Chart: argo/argo-cd — pin version on the helm command (e.g. 9.4.17).
# UI/API: **Ingress** via **Traefik** at **argo.apps.noble.lab.pcenicni.dev** (TLS: cert-manager
# ClusterIssuer + **`server.insecure`** so TLS terminates at Traefik).
# DNS: **`argo.apps.noble.lab.pcenicni.dev`** → Traefik LB **192.168.50.211** (same wildcard as apps).
#
# helm repo add argo https://argoproj.github.io/argo-helm
# helm upgrade --install argocd argo/argo-cd -n argocd --create-namespace \
#   --version 9.4.17 -f clusters/noble/bootstrap/argocd/values.yaml --wait
#
# Initial admin password: kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d
#
# Optional: kubectl apply -f clusters/noble/bootstrap/argocd/root-application.yaml

global:
  domain: argo.apps.noble.lab.pcenicni.dev

configs:
  # Kustomize **helmCharts** in **clusters/noble/apps/kustomization.yaml** need Helm inflation.
  cm:
    kustomize.buildOptions: --enable-helm
  params:
    # TLS terminates at Traefik / cert-manager; Argo CD serves HTTP behind the Ingress.
    server.insecure: true

  # RBAC: default authenticated users to read-only; keep local **admin** as full admin.
  # Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/
  rbac:
    policy.default: role:readonly
    policy.csv: |
      g, admin, role:admin

server:
  certificate:
    enabled: true
    domain: argo.apps.noble.lab.pcenicni.dev
    issuer:
      group: cert-manager.io
      kind: ClusterIssuer
      name: letsencrypt-staging

  ingress:
    enabled: true
    ingressClassName: traefik
    hostname: argo.apps.noble.lab.pcenicni.dev
    tls: true
    annotations: {}

  service:
    type: ClusterIP