---
# clusters/dev — the ACTIVE build target overlay.
#
# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here.
# This overlay adds NO resources of its own. Its ONLY job is to patch the shared cluster-vars
# ConfigMap with dev-scoped values (R-ENV-02). The base reconciliation graph is reused verbatim.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base
patches:
  # --- SOPS decryption + bootstrap source (PM-inlined from bootstrap/flux/patches/, 2026-08-16) ---
  # Inlined (not cross-dir file refs) to stay within kustomize's default load restrictions.
  # Realises the commented decryption TODOs in clusters/base and sets the real source URL.
  # The `sops-age` Secret is created out-of-band (bootstrap/sops/install-age-key.sh) — name only.
  - patch: |-
      apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: platform
        namespace: flux-system
      spec:
        decryption:
          provider: sops
          secretRef:
            name: sops-age
  - patch: |-
      apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: apps
        namespace: flux-system
      spec:
        decryption:
          provider: sops
          secretRef:
            name: sops-age
  - patch: |-
      apiVersion: source.toolkit.fluxcd.io/v1
      kind: GitRepository
      metadata:
        name: flux-system
        namespace: flux-system
      spec:
        # Phase-1 bootstrap source: a single Gitea container on the HOST (bootstrap/gitea/),
        # reachable from the cluster on the k3s-dev NAT gateway. PUBLIC repo => Flux needs no
        # creds (NAT-only). Phase 6 cutover -> in-cluster gitea.home.keithjackson.dev (docs/05).
        url: http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git
        ref:
          branch: main
  # --- dev-scoped cluster-vars (R-ENV-02) ---
  - target:
      kind: ConfigMap
      name: cluster-vars
    patch: |-
      - op: replace
        path: /data/CLUSTER_ENV
        value: "dev"
      # DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006.
      - op: replace
        path: /data/ACME_CLUSTER_ISSUER
        value: "letsencrypt-staging"
      # dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
      - op: replace
        path: /data/LONGHORN_DEFAULT_REPLICA_COUNT
        value: "3"
      # smaller retention / volumes to keep the dev workstation footprint light.
      - op: replace
        path: /data/MONITORING_PROMETHEUS_RETENTION
        value: "3d"
      - op: replace
        path: /data/MONITORING_PROMETHEUS_PVC_SIZE
        value: "5Gi"
      - op: replace
        path: /data/MONITORING_LOKI_PVC_SIZE
        value: "5Gi"
      # single-replica control-plane addons in dev (no HA needed to iterate).
      - op: replace
        path: /data/KEYCLOAK_REPLICAS
        value: "1"
      - op: replace
        path: /data/OAUTH2_PROXY_REPLICAS
        value: "1"
      - op: replace
        path: /data/VELERO_RETENTION
        value: "72h"
      # dev-softened Kyverno for cold-start (base defaults Enforce/Fail/3 = prod posture).
      # Not credential-driven — bootstrap-safety knobs so a cold cluster comes up before
      # admission is proven/HA; flip dev to the strict posture once green.
      - op: replace
        path: /data/KYVERNO_VALIDATION_ACTION
        value: "Audit"
      - op: replace
        path: /data/KYVERNO_FORCE_FAILURE_POLICY_IGNORE
        value: "true"
      - op: replace
        path: /data/KYVERNO_ADMISSION_REPLICAS
        value: "1"