From e548a06ebcf1f75881e8bd1f6fc07e1c4a264598 Mon Sep 17 00:00:00 2001
From: chemavx <chemavx@git.chemavx.xyz>
Date: Thu, 18 Jun 2026 06:39:26 +0000
Subject: [PATCH] feat(infisical): add Infisical platform (Phase 1,
 chart-managed pg/redis)

Deploy infisical-standalone 1.9.0 (Infisical v0.158.0) in a dedicated
'infisical' namespace via a multi-source ArgoCD app (chart + values).
Bundled Postgres (dedicated local-path PVC, 8Gi) + Redis. Ingress via
Traefik + cert-manager (letsencrypt-prod) at infisical.chemavx.xyz.

Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are injected
out-of-band via the 'infisical-secrets' Secret (kubectl, IgnoreExtraneous),
NOT in git. Postgres/Redis passwords guard ClusterIP-only in-cluster
services holding ciphertext; acceptable in values per design review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 argocd/application-infisical.yaml | 28 ++++++++++++++++
 infisical/values.yaml             | 56 +++++++++++++++++++++++++++++++
 2 files changed, 84 insertions(+)
 create mode 100644 argocd/application-infisical.yaml
 create mode 100644 infisical/values.yaml

diff --git a/argocd/application-infisical.yaml b/argocd/application-infisical.yaml
new file mode 100644
index 0000000..7d34027
--- /dev/null
+++ b/argocd/application-infisical.yaml
@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: infisical
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/tracking-id: infisical:argoproj.io/Application:argocd/infisical
+spec:
+  destination:
+    namespace: infisical
+    server: https://kubernetes.default.svc
+  project: default
+  sources:
+    - repoURL: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
+      chart: infisical-standalone
+      targetRevision: 1.9.0
+      helm:
+        valueFiles:
+          - $values/infisical/values.yaml
+    - repoURL: https://git.chemavx.xyz/chemavx/k8s-manifests
+      targetRevision: main
+      ref: values
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/infisical/values.yaml b/infisical/values.yaml
new file mode 100644
index 0000000..380de06
--- /dev/null
+++ b/infisical/values.yaml
@@ -0,0 +1,56 @@
+# Infisical platform (Phase 1) — chart: infisical-standalone 1.9.0 (Infisical v0.158.0)
+# Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are NOT here — they live
+# in the out-of-band 'infisical-secrets' Secret (kubectl, IgnoreExtraneous).
+# Postgres/Redis passwords below guard ClusterIP-only services in the isolated infisical
+# namespace; the DB stores only ciphertext (useless without ENCRYPTION_KEY).
+infisical:
+  enabled: true
+  replicaCount: 1
+  kubeSecretRef: infisical-secrets
+  autoBootstrap:
+    enabled: false
+  image:
+    tag: "v0.158.0"
+    pullPolicy: IfNotPresent
+  resources:
+    limits:
+      memory: 1000Mi
+    requests:
+      cpu: 350m
+
+ingress:
+  enabled: true
+  nginx:
+    enabled: false
+  ingressClassName: traefik
+  hostName: infisical.chemavx.xyz
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  tls:
+    - secretName: infisical-tls
+      hosts:
+        - infisical.chemavx.xyz
+
+postgresql:
+  enabled: true
+  name: postgresql
+  fullnameOverride: postgresql
+  auth:
+    username: infisical
+    password: "eeb3d0ec1a98f8582253e74b8f22f7ad9f4b56eaf94679aa"
+    database: infisicalDB
+  primary:
+    persistence:
+      enabled: true
+      storageClass: local-path
+      size: 8Gi
+
+redis:
+  enabled: true
+  name: redis
+  fullnameOverride: redis
+  architecture: standalone
+  usePassword: true
+  auth:
+    password: "b10e20323896054ddacbafffa6b3d71b350c826e6ce3e06f"