---
# Flux Kustomization: Homepage landing dashboard — reconciles ./platform/homepage.
#
# POST-PLATFORM TIER (dependsOn platform-config). Homepage is a LEAF landing UI at the apex
# home.keithjackson.dev. It depends on the trusted wildcard TLS cert + the shared Gateway (incl. the
# `https-apex` listener) + split-horizon DNS — all brought up by `platform` (controllers) and
# `platform-config` (the wildcard Certificate, cilium L2 VIP, Gateway). It therefore MUST NOT live in
# the gating `platform` tier: a UI whose pod can be unhealthy would keep `platform` not-Ready, and
# while `platform` is not-Ready NOTHING downstream reconciles — the exact incident behind the
# headlamp/oauth2-proxy moves (DECISIONS-LOG: "Headlamp gating stall"). Same lesson, same fix: a leaf
# that can be legitimately unhealthy reconciles in its OWN post-platform Kustomization.
#
# NON-GATING (wait:false): nothing in the graph dependsOn homepage (apps waves gate on
# platform-config, not on this), and a dashboard pod can be long-not-Ready during a cold start.
# wait:false guarantees its health can NEVER gate anything, even if a future resource is (mistakenly)
# pointed dependsOn it.
#
# NO SOPS decryption stanza: this component carries no encrypted Secret (plain manifests + a config
# ConfigMap with no API keys), so — unlike headlamp/oauth2-proxy — clusters/dev does NOT patch it.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: homepage
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: false
  dependsOn:
    - name: platform-config   # wildcard TLS + Gateway (incl. https-apex listener) + split-horizon VIP first
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/homepage
  # LOAD-BEARING, not parity decoration (the comment here used to say the opposite). This component
  # references ${BASE_DOMAIN} in TWO places: httproute.yaml's apex hostname, and EVERY tile href in
  # configmap.yaml. Without this substitution the token is applied LITERALLY — the apex route binds
  # the host `${BASE_DOMAIN}`, which matches no Gateway listener, and every link on the operator's
  # front door points at a host that does not exist — while Flux still reports this Kustomization
  # Ready. It fails OPEN. Asserted by conformance/tests/l0-static/c2-root-surface (5).
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars