---
# Onboarded services (WS-APPS). Each app is rendered from its catalog/ ServiceDefinition by
# catalog/render.py and committed here; the `apps` Flux Kustomization (clusters/base/apps.yaml,
# dependsOn platform-config) reconciles this directory. Image-automation CRs are omitted for now
# (--no-image-automation) until the Flux image controllers are installed.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - pihole.yaml
  - gitea.yaml
  - gitea-bootstrap-secret.sops.yaml   # SOPS: fixed SECRET_KEY + break-glass admin creds (decrypted by Flux)
  - gitea-actions.yaml                 # Phase 6 CI/CD: in-cluster act_runner (ns gitea-actions) + DinD
  - gitea-actions-runner-secret.sops.yaml  # SOPS: act_runner registration token (decrypted by Flux)
  - sonarr.yaml
  - radarr.yaml
  - plex.yaml
  - qbittorrent.yaml
  - jackett.yaml
  - seerr.yaml
# Gitea-only supplementary patch: headless-install env + break-glass admin postStart hook.
# The renderer does not yet emit env/lifecycle (renderer follow-up); see gitea-bootstrap-patch.yaml.
patches:
  - path: gitea-bootstrap-patch.yaml