From 0abadd31312916c8859c2f29921162f3b24dc483 Mon Sep 17 00:00:00 2001
From: Keith Jackson <keithallenjackson@gmail.com>
Date: Wed, 26 Aug 2026 02:04:26 -0500
Subject: [PATCH] apps: temp-disable semaphore (interactive-setup crashloop
 blocked apps reconcile)

The semaphoreui/semaphore image falls through to its interactive setup wizard
and panics on /etc/semaphore/config.json permission-denied; the env-only pattern
doesn't yield a non-interactive config. Backed out to unblock the apps
Kustomization; files retained for a proper config-model follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 apps/kustomization.yaml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/kustomization.yaml b/apps/kustomization.yaml
index c4c126e..042a80b 100644
--- a/apps/kustomization.yaml
+++ b/apps/kustomization.yaml
@@ -21,10 +21,15 @@ resources:
   - nextcloud-db.yaml                      # CNPG PostgreSQL Cluster (ns nextcloud-db) — first CNPG-DB app
   - nextcloud-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
   - nextcloud-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password (ns nextcloud)
-  - semaphore.yaml
-  - semaphore-db.yaml                      # CNPG PostgreSQL Cluster (ns semaphore-db) — second CNPG-DB app
-  - semaphore-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
-  - semaphore-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password + access-key-encryption (ns semaphore)
+  # TEMP-DISABLED (WS-APPS follow-up): semaphore crashloops because the semaphoreui/semaphore image
+  # falls through to its INTERACTIVE setup wizard (env vars didn't yield a non-interactive config)
+  # and panics on `open /etc/semaphore/config.json: permission denied`. It needs a proper config
+  # model (a mounted config.json / the right entrypoint + non-root writable config dir), not the
+  # env-only pattern. Re-enable once fixed. Files retained: catalog/semaphore.yaml, apps/semaphore*.
+  # - semaphore.yaml
+  # - semaphore-db.yaml
+  # - semaphore-db-app.sops.yaml
+  # - semaphore-bootstrap-secret.sops.yaml
 # Gitea's headless-install env + break-glass admin postStart hook are now first-class in the
 # ServiceDefinition (catalog/gitea.yaml env/lifecycle, schema >=1.2.0) and rendered inline into
 # apps/gitea.yaml, so the former gitea-bootstrap-patch.yaml strategic-merge patch is retired.