.forgejo/workflows/build.yaml

@@ -0,0 +1,18 @@
+name: Build
+on: [push]
+
+jobs:
+  build:
+    runs-on: k8s
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://git.qcampos.fr/system/actions/setup-kaniko@main
+
+      - name: Build and push
+        uses: docker://gcr.io/kaniko-project/executor:debug
+        with:
+          args: >-
+            --context dir:///github/workspace
+            --destination git.qcampos.fr/${{ github.repository }}-backend:latest
+            --destination git.qcampos.fr/${{ github.repository }}-backend:${{ github.sha }}
+            --skip-tls-verify

Dockerfile

@@ -0,0 +1,5 @@
+FROM python:alpine
+
+RUN ["touch", "barrrrrrr.txt"]
+
+CMD ["python", "-c", "'import this'"]

ansible/README.md

@@ -1,3 +0,0 @@
-# Ansible Playbook
-
-This playbook is used to boostrap the cluster by installing the cluster and ArgoCD configuration.

ansible/bootstrap.yaml

@@ -1,192 +0,0 @@
----
-- name: Bootstrap K3s and ArgoCD
-  hosts: vps
-  become: yes
-  vars:
-    # URL of the official ArgoCD manifest
-    argocd_manifest_url: "https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml"
-    # Local path to the root-app.yaml manifest (at the root of the repository)
-    root_app_path: "../root-app.yaml"
-    
-    # Tailscale secrets are retrieved from environment variables
-    tailscale_client_id: "{{ lookup('ansible.builtin.env', 'TAILSCALE_CLIENT_ID') | default('', true) }}"
-    tailscale_client_secret: "{{ lookup('ansible.builtin.env', 'TAILSCALE_CLIENT_SECRET') | default('', true) }}"
-
-
-  tasks:
-    # =========================================================================
-    # INITIAL NODE CONFIGURATION
-    # =========================================================================
-    - name: Initial Node Configuration
-      block:
-        - name: Install prerequisites
-          ansible.builtin.apt:
-            name:
-              - curl
-              - git
-              - ca-certificates
-              - python3-kubernetes
-            state: present
-            update_cache: yes
-
-    # =========================================================================
-    # K3S INSTALLATION AND CONFIGURATION
-    # =========================================================================
-    - name: K3s Installation and Configuration
-      block:
-        - name: Check if K3s is already installed
-          ansible.builtin.stat:
-            path: /usr/local/bin/k3s
-          register: k3s_bin
-
-        - name: Install K3s (default configuration)
-          ansible.builtin.shell: |
-            curl -sfL https://get.k3s.io | sh -
-          when: not k3s_bin.stat.exists
-
-        - name: Ensure ~/.kube directory exists
-          ansible.builtin.file:
-            path: ~/.kube
-            state: directory
-            mode: '0700'
-
-        - name: Copy K3s kubeconfig to default root config
-          ansible.builtin.copy:
-            src: /etc/rancher/k3s/k3s.yaml
-            dest: ~/.kube/config
-            remote_src: yes
-            owner: root
-            group: root
-            mode: '0600'
-
-        - name: Also configure kubeconfig for the ansible_user
-          block:
-            - name: Ensure non-root user ~/.kube directory exists
-              ansible.builtin.file:
-                path: "/home/{{ ansible_user }}/.kube"
-                state: directory
-                owner: "{{ ansible_user }}"
-                group: "{{ ansible_user }}"
-                mode: '0700'
-
-            - name: Copy K3s kubeconfig to non-root user config
-              ansible.builtin.copy:
-                src: /etc/rancher/k3s/k3s.yaml
-                dest: "/home/{{ ansible_user }}/.kube/config"
-                remote_src: yes
-                owner: "{{ ansible_user }}"
-                group: "{{ ansible_user }}"
-                mode: '0600'
-          when: ansible_user is defined and ansible_user != 'root'
-
-        - name: Wait for K3s node to be ready
-          ansible.builtin.shell: |
-            kubectl get nodes | grep -q -w "Ready"
-          register: node_status
-          until: node_status.rc == 0
-          retries: 30
-          delay: 5
-          changed_when: false
-
-        - name: Create tailscale namespace
-          kubernetes.core.k8s:
-            definition:
-              apiVersion: v1
-              kind: Namespace
-              metadata:
-                name: tailscale
-            state: present
-
-        - name: Create "operator-oauth" tailscale secret if credentials are provided
-          kubernetes.core.k8s:
-            definition:
-              apiVersion: v1
-              kind: Secret
-              metadata:
-                name: operator-oauth
-                namespace: tailscale
-              type: Opaque
-              stringData:
-                client_id: "{{ tailscale_client_id }}"
-                client_secret: "{{ tailscale_client_secret }}"
-            state: present
-          when: tailscale_client_id != "" and tailscale_client_secret != ""
-
-    # =========================================================================
-    # ARGOCD INSTALLATION
-    # =========================================================================
-    - name: ArgoCD Installation
-      block:
-        - name: Create ArgoCD namespace
-          kubernetes.core.k8s:
-            definition:
-              apiVersion: v1
-              kind: Namespace
-              metadata:
-                name: argocd
-            state: present
-
-        - name: Install ArgoCD (Server-Side Apply)
-          kubernetes.core.k8s:
-            src: "{{ argocd_manifest_url }}"
-            namespace: argocd
-            state: present
-            apply: true
-            server_side_apply:
-              field_manager: ansible
-              force_conflicts: true
-
-        - name: Wait for ArgoCD Server deployment to be operational
-          ansible.builtin.shell: |
-            kubectl rollout status deployment/argocd-server -n argocd --timeout=300s
-          changed_when: false
-
-    # =========================================================================
-    # SYSTEM BOOTSTRAP (Cert-Manager, ClusterIssuer, Forgejo)
-    # =========================================================================
-    - name: System Bootstrap (Cert-Manager, ClusterIssuer, Forgejo)
-      block:
-        - name: Install Cert-Manager (from official manifest)
-          kubernetes.core.k8s:
-            src: "https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml"
-            state: present
-            apply: true
-            server_side_apply:
-              field_manager: ansible
-              force_conflicts: true
-
-        - name: Wait for Cert-Manager webhook to be ready
-          ansible.builtin.shell: |
-            kubectl rollout status deployment/cert-manager-webhook -n cert-manager --timeout=300s
-          changed_when: false
-
-        - name: Deploy Let's Encrypt ClusterIssuer
-          kubernetes.core.k8s:
-            definition: "{{ lookup('file', '../platform/cluster/lets-encrypt.yaml') }}"
-            state: present
-
-        - name: Deploy Forgejo Namespace
-          kubernetes.core.k8s:
-            definition: "{{ lookup('file', '../platform/forgejo/namespace.yaml') }}"
-            state: present
-
-        - name: Deploy Forgejo Instance resources
-          kubernetes.core.k8s:
-            definition: "{{ lookup('file', '../platform/forgejo/instance/' ~ item) }}"
-            state: present
-          loop:
-            - registry-secret.yaml
-            - pvc.yaml
-            - service.yaml
-            - deployment.yaml
-            - ingress.yaml
-
-        - name: Deploy Forgejo Runner resources
-          kubernetes.core.k8s:
-            definition: "{{ lookup('file', '../platform/forgejo/runner/' ~ item) }}"
-            state: present
-          loop:
-            - secret.yaml
-            - pvc.yaml
-            - configmap.yaml
-            - deployment.yaml

ansible/inventory.ini

@@ -1,3 +0,0 @@
-[vps]
-# Main VPS
-porygon2 ansible_host=porygon2.qcampos.fr ansible_port=58123 ansible_user=qcampos

ansible/requirements.txt

@@ -1,2 +0,0 @@
-ansible
-kubernetes

bootstrap/argocd-tailscale-expose.yaml

@@ -8,7 +8,7 @@ spec:
     service:
       name: argocd-server
       port:
-        number: 443
+        number: 80
   ingressClassName: tailscale
   tls:
     - hosts:

bootstrap/root-app.yaml

@@ -7,7 +7,7 @@ spec:
   project: default
   source:
     repoURL: 'https://git.qcampos.fr/qcampos/system.git'
-    path: gitops
+    path: bootstrap
     targetRevision: main
   destination:
     server: 'https://kubernetes.default.svc'

bootstrap/tailscape-operator.yaml

@@ -3,13 +3,11 @@ kind: Application
 metadata:
   name: tailscale-operator
   namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
 spec:
   project: default
   source:
     repoURL: 'https://git.qcampos.fr/qcampos/system.git'
-    path: platform/tailscale-operator
+    path: system/tailscale
     targetRevision: main
   destination:
     server: 'https://kubernetes.default.svc'
@@ -17,6 +15,6 @@ spec:
   syncPolicy:
     automated:
       prune: true
-      selfHeal: true
+      selfHeal: false
     syncOptions:
       - CreateNamespace=true

git-forgejo/instance/deployment.yaml

@@ -25,18 +25,18 @@ spec:
           name: ssh
         env:
         - name: FORGEJO__database__DB_TYPE
-          value: sqlite3 # Lightweight for your VPS
+          value: sqlite3 # Léger pour ton VPS
         - name: FORGEJO__server__DOMAIN
           value: git.qcampos.fr
         - name: FORGEJO__server__ROOT_URL
           value: https://git.qcampos.fr/
-        # Enable package registry
+        # Activation du Registre d'images
         - name: FORGEJO__packages__ENABLED
           value: "true"
         # Required for OCI/container image pushes (chunked upload temp dir)
         - name: FORGEJO__packages__CHUNKED_UPLOAD_PATH
           value: /data/tmp/package-chunked-upload
-        # Enable Actions (CI/CD)
+        # Activation des Actions (CI/CD)
         - name: FORGEJO__actions__ENABLED
           value: "true"
         volumeMounts:

git-forgejo/runner/configmap.yaml

@@ -1,5 +1,5 @@
-# ConfigMap containing the runner configuration (config.yaml file).
-# This file is mounted in the pod and passed to the runner via --config.
+# ConfigMap contenant la configuration du runner (fichier config.yaml).
+# Ce fichier est monté dans le pod et passé au runner via --config.
 apiVersion: v1
 kind: ConfigMap
 metadata:

git-forgejo/runner/secret.yaml

@@ -13,4 +13,4 @@ metadata:
   namespace: forgejo
 stringData:
   # Remplacer par le token copié depuis l'interface Forgejo.
-  registration-token: "SHdSfwt8mtWNq2RGp0mS0HyuXyhNKu5yHokITMnK"
+  registration-token: "LOqadesvfA2tjVRoyWUxCnzYjmgMhZqhHHT30nnp"

gitops/README.md

@@ -1 +0,0 @@
-Loopback from the App of Apps (`/root-app.yaml`) that adds the manually installed base tools to ArgoCD to be automatically managed and self-healing. 

gitops/argocd-config-app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd-config
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-spec:
-  project: default
-  source:
-    repoURL: 'https://git.qcampos.fr/qcampos/system.git'
-    path: platform/argocd
-    targetRevision: main
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: argocd
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

gitops/cert-manager-app.yaml

@@ -1,26 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cert-manager
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  project: default
-  source:
-    repoURL: 'https://charts.jetstack.io'
-    chart: cert-manager
-    targetRevision: v1.14.5
-    helm:
-      parameters:
-        - name: installCRDs
-          value: "true"
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: cert-manager
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

gitops/cluster-issuer-app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cluster-issuer
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: default
-  source:
-    repoURL: 'https://git.qcampos.fr/qcampos/system.git'
-    path: platform/cluster
-    targetRevision: main
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: cert-manager
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

gitops/forgejo-app.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: forgejo
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "4"
-spec:
-  project: default
-  source:
-    repoURL: 'https://git.qcampos.fr/qcampos/system.git'
-    path: platform/forgejo
-    targetRevision: main
-    directory:
-      recurse: true
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: forgejo
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

platform/README.md

@@ -1 +0,0 @@
-Base tools that are "manually" installed by Ansible to boostrat the cluster.

platform/tailscale-operator/Chart.yaml

@@ -1,10 +0,0 @@
-apiVersion: v2
-name: tailscale-operator-wrapper
-description: Wrapper Helm chart for the official Tailscale Operator
-type: application
-version: 1.0.1
-appVersion: 1.98.4
-dependencies:
-  - name: tailscale-operator
-    version: 1.98.4
-    repository: https://pkgs.tailscale.com/helmcharts

system/argocd/argocd-ingress.yaml

@@ -0,0 +1,26 @@
+# For the ingress that connects to the HTTP port of ArgoCD
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd-server-ingress
+  namespace: argocd
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-http"
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - argo.qcampos.fr
+    secretName: argocd-server-tls
+  rules:
+  - host: argo.qcampos.fr
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: argocd-server
+            port:
+              number: 80

system/argocd/values.yaml

@@ -0,0 +1,67 @@
+# Values.yaml for the Argo helm chart
+global:
+  hosts:
+    domain: qcampos.fr
+    gitlab:
+      name: git.qcampos.fr
+  ingress:
+    configureCertmanager: false
+    class: traefik
+    annotations:
+      cert-manager.io/cluster-issuer: "letsencrypt-http"
+      traefik.ingress.kubernetes.io/router.tls: "true"
+  kas:
+    enabled: false # Désactivation de l'agent K8s interne
+
+# Regroupement de toute la section gitlab
+gitlab:
+  upgradeCheck:
+    enabled: false
+  webservice:
+    workerProcesses: 1 
+    resources:
+      limits:
+        memory: 1.5Gi
+      requests:
+        memory: 1Gi # On définit un minimum pour éviter que K3s ne le refuse
+  sidekiq:
+    concurrency: 1
+    resources:
+      limits:
+        memory: 750Mi # Sidekiq a besoin d'un peu plus de 500Mo pour charger Rails au démarrage
+      requests:
+        memory: 500Mi
+  toolbox:
+    enabled: true 
+  gitaly: # Ajout crucial : Gitaly est très gourmand par défaut
+    resources:
+      limits:
+        memory: 1Gi
+      requests:
+        memory: 500Mi
+
+# Désactivation des services d'observabilité (Lourds)
+prometheus:
+  install: false
+gitlab-exporter:
+  enabled: false
+grafana:
+  install: false
+registry:
+  enabled: false
+gitlab-runner:
+  install: false
+
+# Optimisation des bases de données
+postgresql:
+  resources:
+    requests:
+      memory: 256Mi
+redis:
+  resources:
+    requests:
+      memory: 128Mi
+minio:
+  resources:
+    requests:
+      memory: 128Mi

system/cluster/cluster-issuer.yaml

@@ -4,7 +4,7 @@ metadata:
   name: letsencrypt-http
 spec:
   acme:
-    email: quentin.campos@gmail.com # Email for end of validity notifications
+    email: quentin.campos@gmail.com # Ton email pour les alertes de fin de validité
     server: https://acme-v02.api.letsencrypt.org/directory
     privateKeySecretRef:
       name: letsencrypt-http-issuer-key