apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: mastodon
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  sources:
    - repoURL: http://gitea.gitea.svc.cluster.local:3000/admin/main.git
      targetRevision: master
      path: manifests/mastodon
      directory:
        recurse: true
        include: "*.yaml"
    - repoURL: https://mastodon.github.io/helm-charts/
      chart: mastodon
      targetRevision: "1.0.3"
      helm:
        values: |
          mastodon:
            localDomain: mastodon.t0rt1k.tech

            secrets:
              secretKeyBase: c858bb02549193f4677f06db375f6015c282d7c2912c0a894bdcab66948f5ebcbf10286c94bcec8306cf704ecfe8c59a871fb14bcc29b50bad4c192039f84c25
              vapidPrivateKey: 5mrGQP9Cvo_t5hPwuVzY-zGfK-2pScDk42yhTwN193c=
              vapidPublicKey: BF5GrO2MLqWBbIDhgmQP6xMMfqdor0Fm3KkjsMx_QYB5kKzdDvACwA59SP3T9zWWe5dB7EsYbHe-LF6S0sV7DKk=
              arePrimaryKey: 2kcXaHigLHS0HDAPyGv53M4QJxZ7VTPCKqrIxnHyK+M=
              areDeterministicKey: Oy5iD9DVPiCZu0PDKiv+R0MgvDHu7xYTT+U7Ml6HeBA=
              areKeyDerivationSalt: UiOT/p0DYXIQ82yABJlCErrPB/VSneb7jW+XQ6TBHrg=

            hooks:
              deploySearch:
                enabled: true

            s3:
              enabled: true
              hostname: mastodon.t0rt1k.tech
              endpoint: http://minio.minio.svc.cluster.local
              protocol: http
              bucket: mastodon
              existingSecret: mastodon-s3
              overridePathStyle: "false"

            web:
              resources:
                requests:
                  cpu: 100m
                  memory: 256Mi
                limits:
                  cpu: 500m
                  memory: 1Gi

            sidekiq:
              workers:
                - name: all-queues
                  replicas: 1
                  concurrency: 15
                  resources:
                    requests:
                      cpu: 100m
                      memory: 256Mi
                    limits:
                      cpu: 500m
                      memory: 512Mi

            streaming:
              replicas: 1
              resources:
                requests:
                  cpu: 50m
                  memory: 128Mi
                limits:
                  cpu: 250m
                  memory: 256Mi

            smtp:
              fromAddress: notifications@t0rt1k.tech
              server: smtp.example.com
              port: 587
              username: dummy
              password: dummy

          externalAuth:
            oidc:
              enabled: true
              displayName: "t0rt1k.tech matrix"
              issuer: https://auth.t0rt1k.tech/
              discovery: true
              scope: "openid"
              uidField: username
              clientId: 01KXBMX4RKEYG24GW7ZXXHFD01
              clientSecret: o9GCnfhbw1jFaTPwJ4vm
              redirectUri: https://mastodon.t0rt1k.tech/auth/auth/openid_connect/callback
              assumeEmailIsVerified: true
              clientAuthMethod: "client_secret_post"
            oauthGlobal:
              omniauthOnly: true

          postgresql:
            hostname: shared-pg-rw.cnpg.svc.cluster.local
            port: 5432
            database: mastodon
            username: mastodon
            password: change-me

          redis:
            hostname: redis-master.redis.svc.cluster.local
            port: 6379
            password: change-me

          elasticsearch:
            enabled: true
            hostname: shared-os.opensearch.svc.cluster.local
            port: 9200
            tls: false
            preset: single_node_cluster
            username: dummy
            password: dummy
          ingress:
            enabled: true
            className: traefik
            annotations:
              cert-manager.io/cluster-issuer: letsencrypt-production
              traefik.ingress.kubernetes.io/router.entrypoints: websecure
              traefik.ingress.kubernetes.io/router.tls: "true"
            hosts:
              - host: mastodon.t0rt1k.tech
                paths:
                  - path: /
                    pathType: Prefix
            tls:
              - secretName: mastodon-tls
                hosts:
                  - mastodon.t0rt1k.tech

          httproute:
            enabled: false
  destination:
    server: https://kubernetes.default.svc
    namespace: mastodon
  syncPolicy:
    syncOptions:
      - CreateNamespace=true