---
# Onboarded services (WS-APPS). Each app is rendered from its catalog/ ServiceDefinition by
# catalog/render.py and committed here; the `apps` Flux Kustomization (clusters/base/apps.yaml,
# dependsOn platform-config) reconciles this directory. Image-automation CRs are omitted for now
# (--no-image-automation) until the Flux image controllers are installed.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - pihole.yaml
  - gitea.yaml
  - gitea-bootstrap-secret.sops.yaml   # SOPS: fixed SECRET_KEY + break-glass admin creds (decrypted by Flux)
  - gitea-actions.yaml                 # Phase 6 CI/CD: in-cluster act_runner (ns gitea-actions) + DinD
  - gitea-actions-runner-secret.sops.yaml  # SOPS: act_runner registration token (decrypted by Flux)
  - sonarr.yaml
  - radarr.yaml
  - plex.yaml
  - qbittorrent.yaml
  - jackett.yaml
  - seerr.yaml
  - nextcloud.yaml
  - nextcloud-db.yaml                      # CNPG PostgreSQL Cluster (ns nextcloud-db) — first CNPG-DB app
  - nextcloud-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
  - nextcloud-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password (ns nextcloud)
  # TEMP-DISABLED (WS-APPS follow-up): semaphore crashloops because the semaphoreui/semaphore image
  # falls through to its INTERACTIVE setup wizard (env vars didn't yield a non-interactive config)
  # and panics on `open /etc/semaphore/config.json: permission denied`. It needs a proper config
  # model (a mounted config.json / the right entrypoint + non-root writable config dir), not the
  # env-only pattern. Re-enable once fixed. Files retained: catalog/semaphore.yaml, apps/semaphore*.
  # - semaphore.yaml
  # - semaphore-db.yaml
  # - semaphore-db-app.sops.yaml
  # - semaphore-bootstrap-secret.sops.yaml
# Gitea's headless-install env + break-glass admin postStart hook are now first-class in the
# ServiceDefinition (catalog/gitea.yaml env/lifecycle, schema >=1.2.0) and rendered inline into
# apps/gitea.yaml, so the former gitea-bootstrap-patch.yaml strategic-merge patch is retired.
# gitea-bootstrap-secret.sops.yaml is KEPT — the env still sources the fixed SECRET_KEY + admin
# creds from it via secretKeyRef.