T-0.3 ServiceDefinition schema + renderer contract + examples (R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

catalog/pihole.yaml

@@ -0,0 +1,33 @@
+# ServiceDefinition: pihole
+# Source of truth: spec docs/13-service-catalog.md, row 6.
+# internal | egress internet | config on Longhorn (DR-critical config) | auth forward-auth.
+# Also a platform DNS dependency (docs/09). Validates against schemas/servicedefinition.schema.json.
+name: pihole
+kind: container
+source:
+  image: pihole/pihole
+exposure: internal            # LAN-only admin UI (docs/13 row 6; R-DNS/R-NET)
+egress: internet              # normal WAN egress (docs/03; R-NET-05)
+storage:
+  - name: config
+    size: 2Gi
+    class: longhorn           # replicated config state; DR-critical (docs/04 line 118; R-STATE-02/03)
+dependencies: []              # default-deny: reaches only DNS; it PROVIDES DNS (docs/03; R-NET-01/02)
+ingressRoutes:
+  - host: pihole.home.keithjackson.dev
+    port: 80                  # admin web UI, protected at the Gateway by forward-auth (docs/09)
+auth:
+  mode: forward-auth          # oauth2-proxy -> Keycloak; bare UI, no native OIDC (docs/15; R-IDP-02)
+  groups:
+    - platform-admins         # sensitive admin UI: authenticated AND in group (R-IDP-06)
+update:
+  channel: stable             # R-UPD-01
+  range: ">=2024.0.0"
+  cadence: "0 4 * * *"
+  autoRollbackOnFailedHealth: true   # R-UPD-03
+observability:
+  metrics: true
+  slis:
+    - up                      # R-OBS-01
+backup:
+  policy: daily-offcluster    # PiHole config is DR-critical (docs/04 line 118; R-STATE-03)