# archify-vscode-ext-sync-gitops-tmpl

[![Buy me a coffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/root.at.skic)

A [Copier](https://copier.readthedocs.io) template for deploying [Archify Sync](https://gitea.lego-cloud.eu/vscode-extensions/archify-vscode-ext-sync) with [Argo CD](https://argo-cd.readthedocs.io). It renders an environment repository that Argo CD syncs: an app-of-apps, the server's Helm chart (taken from the server repository) and its values. Keep your answers in the environment repository; never hand-edit what Copier renders there.

```text
cluster/
├── 0000-bootstrap/0100-app-of-apps.yml.jinja    # root app 0000-archify-sync-app-of-apps, applied once
├── 0300-applications/
│   ├── application.yml.jinja                    # the root app managing itself
│   ├── {{ '0100-archify-sync-secrets' if … }}/  # optional: secrets through External Secrets
│   ├── {{ '0150-archify-sync-storage' if … }}/  # optional: a static NFS volume for PostgreSQL
│   └── {{ '0200-archify-sync' if … }}/          # the chart from the server repo + values from here
└── 0500-resources/                              # what those apps deploy
```

Answers: `argocd` (namespace, project, the environment repository and revision) and `archify_sync` (`is_enabled`, chart source, image, host, database, single sign-on, metrics, `external_secrets`). `copier-answers.example.yml` is a complete example.

## Use it

1. **Image.** Build the server image from the server repository's Dockerfile and push it to your registry (`image.repository`, `image.tag`). For a private registry, name an image pull Secret in `image.pull_secret`.
2. **Identity provider.** Create the client and groups described in the server's README (single sign-on section).
3. **Secrets.** Without External Secrets, create the server's Secret yourself; the bundled PostgreSQL and the server read it:

   ```bash
   kubectl create namespace archify-sync
   kubectl -n archify-sync create secret generic archify-sync-secrets \
     --from-literal=password="$PG_PASSWORD" \
     --from-literal=url="postgres://archify:$PG_PASSWORD@archify-sync-postgresql:5432/archify" \
     --from-literal=client-secret="$OIDC_CLIENT_SECRET"
   ```

   The password goes into a URL: letters and digits only. With [External Secrets](https://external-secrets.io) installed, set `external_secrets.store` and the names of the two entries instead, and `external_secrets.image_pull` for a private registry; the template then renders the ExternalSecrets.
4. **Render.** Into a new environment repository, from your answers:

   ```bash
   copier copy --trust \
     --data-file my-answers.yml \
     https://gitea.lego-cloud.eu/vscode-extensions/archify-vscode-ext-sync-gitops-tmpl.git \
     ../archify-sync-gitops
   ```

   Push it where Argo CD can read it (`argocd.repo_url`).
5. **Connect.** Give Argo CD access to the environment repository, then `kubectl apply -f cluster/0000-bootstrap/0100-app-of-apps.yml` once. After that the app-of-apps manages itself.

Behind the ingress the server needs WebSocket upgrades and long read and send timeouts; the rendered values set them for ingress-nginx.

## Tasks

```bash
task validate        # render off, on, and with External Secrets into tmp/; check YAML and paths; helm lint the values
task render          # a new template version: copier update in the environment repo (ENV_DIR)
task render:answers  # after editing the environment repo's cluster/copier-answers.yml: copier recopy
```

`copier update` needs this repository committed and tagged; the environment repository records the template's version.

## Support

Archify Sync is built and maintained in my spare time. If it helps you, a coffee keeps the releases coming:

[![Buy me a coffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/root.at.skic)