feat(gitops): base→type→cluster layering via ApplicationSet

.gitignore

@@ -0,0 +1,3 @@
+
+# bootstrap secret values — delivered via Omni, never committed
+omni/secrets.env

.mise.toml

@@ -0,0 +1,12 @@
+[tools]
+helm = "3.17.0"
+yq = "4"
+kubectl = "1.34"
+
+[tasks."oci:generate-manifests"]
+description = "Regenerate OCI (oci-talos) Talos inline-manifests: argocd + cilium + appset"
+run = "omni/scripts/generate-manifests.sh oci-talos"
+
+[tasks."unraid:generate-manifests"]
+description = "Regenerate unraid-lab Talos inline-manifests: argocd + appset"
+run = "omni/scripts/generate-manifests.sh unraid-lab"

apps/cert-manager/app.yaml

@@ -0,0 +1,6 @@
+# App coords consumed by the layering ApplicationSet. Values layer:
+# values/base/cert-manager.yaml -> types/<type>/ -> clusters/<name>/ (deep-merge, later wins).
+chart: cert-manager
+repoURL: https://charts.jetstack.io
+version: "v1.17.1"
+namespace: cert-manager

apps/cilium/app.yaml

@@ -0,0 +1,4 @@
+chart: cilium
+repoURL: https://helm.cilium.io
+version: "1.17.18"
+namespace: kube-system

appset.yaml

@@ -0,0 +1,85 @@
+# Layering ApplicationSet — the "chart-app" engine.
+#
+# SEEDED PER CLUSTER by the Talos inline manifests. The two `list` elements below
+# (clusterName / clusterType) are the ONLY per-cluster difference — each cluster's
+# inline manifest embeds this file with its own identity. This copy is the
+# canonical reference; the identities here are placeholders.
+#
+# Selection (which apps run): three git generators —
+#   apps/*/app.yaml                        shared (every cluster)
+#   types/<clusterType>/apps/*/app.yaml    per cluster-TYPE
+#   clusters/<clusterName>/apps/*/app.yaml per CLUSTER
+# Values (override anything the chart exposes): deep-merge valueFiles —
+#   values/base/<app>.yaml -> values/types/<type>/<app>.yaml -> values/clusters/<name>/<app>.yaml
+# Custom ApplicationSets (e.g. arc-runners) are NOT chart-apps and run on the raw
+# directory-sync lane (clusters/<name>/apps/*/application.yaml), not here.
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: apps
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+    - matrix:                                   # shared apps
+        generators:
+          - list:
+              elements:
+                - clusterName: CLUSTER_NAME
+                  clusterType: CLUSTER_TYPE
+          - git:
+              repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps
+              revision: HEAD
+              files:
+                - path: apps/*/app.yaml
+    - matrix:                                   # per cluster-TYPE apps
+        generators:
+          - list:
+              elements:
+                - clusterName: CLUSTER_NAME
+                  clusterType: CLUSTER_TYPE
+          - git:
+              repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps
+              revision: HEAD
+              files:
+                - path: types/{{.clusterType}}/apps/*/app.yaml
+    - matrix:                                   # per CLUSTER apps
+        generators:
+          - list:
+              elements:
+                - clusterName: CLUSTER_NAME
+                  clusterType: CLUSTER_TYPE
+          - git:
+              repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps
+              revision: HEAD
+              files:
+                - path: clusters/{{.clusterName}}/apps/*/app.yaml
+  template:
+    metadata:
+      name: "{{.path.basename}}"                # app name = its directory name
+    spec:
+      project: default
+      sources:
+        - repoURL: "{{.repoURL}}"
+          chart: "{{.chart}}"
+          targetRevision: "{{.version}}"
+          helm:
+            ignoreMissingValueFiles: true       # type/cluster value files are optional
+            valueFiles:
+              - $v/values/base/{{.path.basename}}.yaml
+              - $v/values/types/{{.clusterType}}/{{.path.basename}}.yaml
+              - $v/values/clusters/{{.clusterName}}/{{.path.basename}}.yaml
+        - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps
+          targetRevision: HEAD
+          ref: v
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: "{{.namespace}}"
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - ServerSideApply=true

clusters/unraid-lab/apps/arc-controller/app.yaml

@@ -0,0 +1,5 @@
+# OCI Helm chart (repoURL is an OCI registry).
+chart: gha-runner-scale-set-controller
+repoURL: ghcr.io/actions/actions-runner-controller-charts
+version: "0.14.2"
+namespace: arc-systems

clusters/unraid-lab/apps/harbor/app.yaml

@@ -0,0 +1,5 @@
+# unraid-lab-only chart-app. Base + cluster values layer.
+chart: harbor
+repoURL: https://helm.goharbor.io
+version: "1.15.1"
+namespace: harbor

clusters/unraid-lab/omni/inline-manifests.yaml

@@ -1,35 +1,42 @@
 # Talos inline manifests for the unraid-lab cluster bootstrap.
 #
 # Talos applies these on the first control-plane node before any scheduler is up.
-# They install Argo CD; two seeded root Applications then fetch everything else
-# from this repo (the "install Argo, then pull the rest remotely" pattern):
+# They install Argo CD; three seeded roots then pull everything else from this
+# repo ("install Argo, then fetch the rest remotely"):
 #
-#   root             -> bootstrap/                 shared infra (app-of-apps -> infrastructure/*)
-#   unraid-lab-apps  -> clusters/unraid-lab/apps/  unraid-lab-only (Harbor, ARC runners)
+#   apps       (ApplicationSet)  -> apps/* + types/homelab-kvm/apps/* + clusters/unraid-lab/apps/*
+#                                   chart-apps, values layered base -> type -> cluster
+#   bootstrap  (Application)     -> bootstrap/                shared raw manifests (tailscale operator)
+#   unraid-raw (Application)     -> clusters/unraid-lab/apps/*/application.yaml
+#                                   custom ApplicationSets that aren't chart-apps (arc-runners)
 #
-# The OCI cluster uses ONE root (bootstrap/ only). unraid-lab needs BOTH, so its
-# cluster-scoped apps under clusters/unraid-lab/ get seeded too — OCI never syncs
-# that path, so those apps stay unraid-lab-only.
+# The chart-app lane keys on app.yaml; the raw lane keys on application.yaml — so
+# arc-runners (an ApplicationSet, application.yaml) and harbor/arc-controller
+# (chart-apps, app.yaml) never double-manage.
 #
-# Argo CD (and Cilium, IF this cluster is CNI-none like OCI — see the CNI decision
-# in omni-on-unraid) are generated the same way OCI does it:
-#   the argocd block below is replaced by argo-cd <version> manifests/install.yaml.
+# Argo CD (and Cilium, IF unraid-lab is CNI-none like OCI — the CNI decision lives
+# in omni-on-unraid) are filled by the generate step, same pattern as OCI.
 
 cluster:
   inlineManifests:
     - name: argocd
       contents: |
-        # !!! PLACEHOLDER — replace with the raw Argo CD install manifest !!!
+        # !!! PLACEHOLDER — raw Argo CD install manifest (namespace argocd) !!!
         # Source: curl -sL https://raw.githubusercontent.com/argoproj/argo-cd/<ARGOCD_VERSION>/manifests/install.yaml
-        # Namespace: argocd (create it in this manifest, as OCI's generated block does)
 
-    - name: argocd-root
+    - name: argocd-apps
+      contents: |
+        # Chart-app lane — inject repo-root appset.yaml with THIS cluster's identity:
+        #   clusterName: unraid-lab, clusterType: homelab-kvm
+        #
+        # !!! generate step injects appset.yaml here !!!
+
+    - name: argocd-bootstrap
       contents: |
-        # Shared infra — identical to what OCI runs.
         apiVersion: argoproj.io/v1alpha1
         kind: Application
         metadata:
-          name: root
+          name: bootstrap
           namespace: argocd
         spec:
           project: default
@@ -45,14 +52,13 @@ cluster:
               prune: true
               selfHeal: true
 
-    - name: argocd-unraid-lab-apps
+    - name: argocd-unraid-raw
       contents: |
-        # unraid-lab-only apps (Harbor, ARC runners). Fans out to
-        # clusters/unraid-lab/apps/*/application.yaml.
+        # Raw lane for unraid-lab custom ApplicationSets (arc-runners).
         apiVersion: argoproj.io/v1alpha1
         kind: Application
         metadata:
-          name: unraid-lab-apps
+          name: unraid-raw
           namespace: argocd
         spec:
           project: default