feat: workload ApplicationSet + charts

argocd/apps/workloads/appset.yaml

@@ -0,0 +1,55 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: workloads
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+    - matrix:
+        generators:
+          - clusters:
+              selector:
+                matchExpressions:
+                  - {key: purpose, operator: In, values: [prod, stage]}
+          - list:
+              elements:
+                - app: mealie
+                  namespace: mealie
+                  wave: "0"
+                - app: plausible
+                  namespace: plausible
+                  wave: "0"
+                - app: changedetection
+                  namespace: changedetection
+                  wave: "0"
+  template:
+    metadata:
+      name: "{{ .app }}-{{ .name }}"
+      annotations:
+        argocd.argoproj.io/sync-wave: "{{ .wave }}"
+    spec:
+      project: default
+      sources:
+        - repoURL: https://github.com/jonathandieu/dieubernetes
+          targetRevision: HEAD
+          ref: values
+        - repoURL: https://github.com/jonathandieu/dieubernetes
+          targetRevision: HEAD
+          path: "charts/workloads/{{ .app }}"
+          helm:
+            releaseName: "{{ .app }}"
+            valueFiles:
+              - values.yaml
+              - "$values/clusters/{{ .name }}/overrides/{{ .app }}.yaml"
+            ignoreMissingValueFiles: true
+      destination:
+        server: "{{ .server }}"
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - ServerSideApply=true

charts/workloads/changedetection/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: changedetection
+description: changedetection.io — website change monitoring (custom chart, no official upstream)
+version: 0.1.0

charts/workloads/changedetection/templates/deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  strategy:
+    type: Recreate  # single instance, PVC can't be multi-attached
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: changedetection
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default "latest" }}"
+          ports:
+            - containerPort: 5000
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: datastore
+              mountPath: /datastore
+      volumes:
+        - name: datastore
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}

charts/workloads/changedetection/templates/httproute.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    {{- toYaml .Values.httproute.hostnames | nindent 4 }}
+  rules:
+    - backendRefs:
+        - name: {{ .Release.Name }}
+          port: 5000

charts/workloads/changedetection/templates/pvc.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

charts/workloads/changedetection/templates/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  selector:
+    app: {{ .Release.Name }}
+  ports:
+    - port: 5000
+      targetPort: 5000

charts/workloads/changedetection/values.yaml

@@ -0,0 +1,18 @@
+image:
+  repository: ghcr.io/dgtlmoon/changedetection.io
+  tag: ""  # managed by Kargo
+
+replicas: 1
+
+httproute:
+  hostnames:
+    - changes.dieu.dev
+
+persistence:
+  enabled: true
+  size: 1Gi
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 128Mi

charts/workloads/mealie/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: mealie
+description: Mealie — self-hosted recipe manager (custom chart, no reliable upstream)
+version: 0.1.0

charts/workloads/mealie/templates/deployment.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  strategy:
+    type: Recreate  # single instance, PVC can't be multi-attached
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: mealie
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default "latest" }}"
+          ports:
+            - containerPort: 9000
+          env:
+            {{- range $k, $v := .Values.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+      volumes:
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}

charts/workloads/mealie/templates/httproute.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    {{- toYaml .Values.httproute.hostnames | nindent 4 }}
+  rules:
+    - backendRefs:
+        - name: {{ .Release.Name }}
+          port: 9000

charts/workloads/mealie/templates/pvc.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

charts/workloads/mealie/templates/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  selector:
+    app: {{ .Release.Name }}
+  ports:
+    - port: 9000
+      targetPort: 9000

charts/workloads/mealie/values.yaml

@@ -0,0 +1,23 @@
+image:
+  repository: ghcr.io/mealie-recipes/mealie
+  tag: ""  # managed by Kargo
+
+replicas: 1
+
+env:
+  ALLOW_SIGNUP: "false"
+  BASE_URL: "https://recipes.dieu.dev"
+  DB_ENGINE: sqlite
+
+httproute:
+  hostnames:
+    - recipes.dieu.dev
+
+persistence:
+  enabled: true
+  size: 1Gi
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi

charts/workloads/plausible/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: plausible
+version: 0.1.0
+dependencies:
+  - name: plausible-analytics
+    version: "0.4.2"
+    repository: https://imio.github.io/helm-charts

charts/workloads/plausible/templates/httproute.yaml

@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - analytics.dieu.dev
+  rules:
+    - backendRefs:
+        - name: {{ .Release.Name }}-plausible-analytics
+          port: 80

charts/workloads/plausible/values.yaml

@@ -0,0 +1,9 @@
+plausible-analytics:  # 8gears/plausible-analytics
+  image:
+    tag: ""  # managed by Kargo
+
+  ingress:
+    enabled: false  # routing via Envoy Gateway HTTPRoute
+
+  baseURL: "https://analytics.dieu.dev"
+  disableRegistration: true