# ${REPO_NAME}

Kubernetes deployment source-of-truth repository for `${REPO_NAME}`.

This template is intended for applications deployed with ArgoCD through an
`ApplicationSet`. It uses a `base/` plus `overlays/` layout, stores runtime
secrets as SOPS-encrypted manifests, and includes Gitea workflows for manifest
validation and dormant-transition PR creation.

## Layout

```text
.
├── .gitea/
│   ├── template
│   └── workflows/
│       ├── dormant-pr.yaml
│       └── validate.yaml
├── bootstrap/
│   ├── applicationset.yaml
│   └── config.yaml
├── manifest/
│   ├── base/
│   │   ├── kustomization.yaml
│   │   ├── runtime/
│   │   │   ├── deployment.yaml
│   │   │   ├── kustomization.yaml
│   │   │   └── service.yaml
│   │   └── state/
│   │       ├── kustomization.yaml
│   │       └── persistentvolumeclaim.yaml
│   ├── components/
│   │   └── example-component/
│   └── overlays/
│       ├── dormant/
│       │   └── kustomization.yaml
│       └── production/
│           ├── ingressroute.yaml
│           ├── kustomization.yaml
│           └── storage/
│               └── persistentvolume-nfs.yaml
├── DORMANT_IMPLEMENTATION_REPORT.md
├── OPERATIONS.md
└── scripts/
```

## Active and dormant overlays

- Active `production` includes runtime resources plus retained state.
- Dormant includes only retained state so Argo CD removes runtime workloads but keeps app data.
- The `bootstrap/applicationset.yaml` `overlay` field is the control point for switching between active and dormant desired state.

## First edits

Update these files before the first deployment:

1. `manifest/base/runtime/deployment.yaml`
   Set the container image, ports, probes, resource requests, and required environment variables.
2. `manifest/overlays/production/ingressroute.yaml`
   Set the real hostname, entry point names, and middleware references if used.
3. `manifest/base/state/persistentvolumeclaim.yaml`
   Set the requested size, access mode, and storage class for the environment.
4. `.sops.yaml`
   Replace the sample age recipient with the public key that ArgoCD should use for decryption.
5. `manifest/overlays/production/secret.secret.yaml`
   Re-encrypt the placeholder secret values with your own data.

## Dormant PR flow

Push a protected tag in the form `dormant/<repo-name>/production`.

The Gitea workflow creates a short-lived branch, changes the ApplicationSet overlay target to `manifest/overlays/dormant`, and opens a pull request against `main`. Merge approval is the dormancy gate. Reactivation is a normal PR that switches `overlay` back to `production`.

See `OPERATIONS.md` for storage prerequisites and required Gitea protections.