T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/base/cluster-vars.yaml

@@ -0,0 +1,41 @@
+---
+# cluster-vars — the overlay knob surface (R-ENV-02).
+#
+# This ConfigMap holds BASE DEFAULTS. Flux `postBuild.substituteFrom` injects these into every
+# `${TOKEN}` in platform/ and apps/ manifests at reconcile time. dev/ and prod/ overlays STRATEGIC-
+# MERGE PATCH this single ConfigMap — that patch is the *entire* difference between environments.
+#
+# Add a knob here (with a base default) before referencing `${KNOB}` in a component manifest, then
+# give each overlay its env-scoped value. Never fork a base manifest to differ per environment.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-vars
+  namespace: flux-system
+data:
+  # --- identity of the environment ---
+  cluster_env: "base"                       # dev | prod  (overlays set this)
+
+  # --- DNS / TLS ---
+  base_domain: "home.keithjackson.dev"      # same in both envs (split-horizon per docs/09)
+  acme_cluster_issuer: "letsencrypt-staging" # dev: staging | prod: letsencrypt-prod (ADR-0006)
+
+  # --- storage (ADR-0003) ---
+  longhorn_default_replica_count: "3"       # default StorageClass replica count (3 on 3 nodes)
+
+  # --- observability sizing (docs/10) ---
+  monitoring_prometheus_retention: "7d"     # dev short | prod long
+  monitoring_prometheus_pvc_size: "10Gi"
+  monitoring_loki_pvc_size: "10Gi"
+
+  # --- identity / auth (ADR-0014) ---
+  keycloak_replicas: "1"                     # dev 1 | prod 2 (HA)
+  oauth2_proxy_replicas: "1"                 # dev 1 | prod 2 (HA)
+
+  # --- backup / DR (ADR-0003, R-STATE-03) ---
+  velero_backup_schedule: "0 3 * * *"        # cron; overlays may differ
+  velero_retention: "168h"                   # dev short | prod long
+
+  # --- placement ---
+  platform_node_selector_key: "kubernetes.io/os"   # base no-op selector; prod may pin roles
+  platform_node_selector_value: "linux"