root-at-skic
e2adb79e2d
A Copier template for deploying Archify Sync with Argo CD: an app-of-apps, the server's Helm chart and its values, optional secrets through External Secrets and an optional static NFS volume for PostgreSQL.
56 lines
3.5 KiB
Markdown
56 lines
3.5 KiB
Markdown
# archify-vscode-ext-sync-gitops-tmpl
|
|
|
|
A [Copier](https://copier.readthedocs.io) template for deploying [Archify Sync](https://gitea.lego-cloud.eu/vscode-extensions/archify-vscode-ext-sync) with [Argo CD](https://argo-cd.readthedocs.io). It renders an environment repository that Argo CD syncs: an app-of-apps, the server's Helm chart (taken from the server repository) and its values. Keep your answers in the environment repository; never hand-edit what Copier renders there.
|
|
|
|
```text
|
|
cluster/
|
|
├── 0000-bootstrap/0100-app-of-apps.yml.jinja # root app 0000-archify-sync-app-of-apps, applied once
|
|
├── 0300-applications/
|
|
│ ├── application.yml.jinja # the root app managing itself
|
|
│ ├── {{ '0100-archify-sync-secrets' if … }}/ # optional: secrets through External Secrets
|
|
│ ├── {{ '0150-archify-sync-storage' if … }}/ # optional: a static NFS volume for PostgreSQL
|
|
│ └── {{ '0200-archify-sync' if … }}/ # the chart from the server repo + values from here
|
|
└── 0500-resources/ # what those apps deploy
|
|
```
|
|
|
|
Answers: `argocd` (namespace, project, the environment repository and revision) and `archify_sync` (`is_enabled`, chart source, image, host, database, single sign-on, metrics, `external_secrets`). `copier-answers.example.yml` is a complete example.
|
|
|
|
## Use it
|
|
|
|
1. **Image.** Build the server image from the server repository's Dockerfile and push it to your registry (`image.repository`, `image.tag`). For a private registry, name an image pull Secret in `image.pull_secret`.
|
|
2. **Identity provider.** Create the client and groups described in the server's README (single sign-on section).
|
|
3. **Secrets.** Without External Secrets, create the server's Secret yourself; the bundled PostgreSQL and the server read it:
|
|
|
|
```bash
|
|
kubectl create namespace archify-sync
|
|
kubectl -n archify-sync create secret generic archify-sync-secrets \
|
|
--from-literal=password="$PG_PASSWORD" \
|
|
--from-literal=url="postgres://archify:$PG_PASSWORD@archify-sync-postgresql:5432/archify" \
|
|
--from-literal=client-secret="$OIDC_CLIENT_SECRET"
|
|
```
|
|
|
|
The password goes into a URL: letters and digits only. With [External Secrets](https://external-secrets.io) installed, set `external_secrets.store` and the names of the two entries instead, and `external_secrets.image_pull` for a private registry; the template then renders the ExternalSecrets.
|
|
4. **Render.** Into a new environment repository, from your answers:
|
|
|
|
```bash
|
|
copier copy --trust \
|
|
--data-file my-answers.yml \
|
|
https://gitea.lego-cloud.eu/vscode-extensions/archify-vscode-ext-sync-gitops-tmpl.git \
|
|
../archify-sync-gitops
|
|
```
|
|
|
|
Push it where Argo CD can read it (`argocd.repo_url`).
|
|
5. **Connect.** Give Argo CD access to the environment repository, then `kubectl apply -f cluster/0000-bootstrap/0100-app-of-apps.yml` once. After that the app-of-apps manages itself.
|
|
|
|
Behind the ingress the server needs WebSocket upgrades and long read and send timeouts; the rendered values set them for ingress-nginx.
|
|
|
|
## Tasks
|
|
|
|
```bash
|
|
task validate # render off, on, and with External Secrets into tmp/; check YAML and paths; helm lint the values
|
|
task render # a new template version: copier update in the environment repo (ENV_DIR)
|
|
task render:answers # after editing the environment repo's cluster/copier-answers.yml: copier recopy
|
|
```
|
|
|
|
`copier update` needs this repository committed and tagged; the environment repository records the template's version.
|