apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: infisical
  namespace: argocd
spec:
  destination:
    namespace: infisical
    server: https://kubernetes.default.svc
  project: default
  # Single-source Helm: remote chart + inline values. (Multi-source $values ref
  # caused the app to prune its own Application object on first sync.)
  source:
    repoURL: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
    chart: infisical-standalone
    targetRevision: 1.9.0
    helm:
      valuesObject:
        # Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are NOT here —
        # they live in the out-of-band 'infisical-secrets' Secret (kubectl, IgnoreExtraneous).
        # Postgres/Redis passwords below guard ClusterIP-only services in the isolated
        # infisical namespace; the DB stores only ciphertext (useless without ENCRYPTION_KEY).
        infisical:
          enabled: true
          replicaCount: 1
          kubeSecretRef: infisical-secrets
          autoBootstrap:
            enabled: false
          image:
            tag: "v0.158.0"
            pullPolicy: IfNotPresent
          resources:
            limits:
              memory: 1000Mi
            requests:
              cpu: 350m
        ingress:
          enabled: true
          nginx:
            enabled: false
          ingressClassName: traefik
          hostName: infisical.chemavx.xyz
          annotations:
            cert-manager.io/cluster-issuer: letsencrypt-prod
            traefik.ingress.kubernetes.io/router.entrypoints: websecure
          tls:
            - secretName: infisical-tls
              hosts:
                - infisical.chemavx.xyz
        postgresql:
          enabled: true
          name: postgresql
          fullnameOverride: postgresql
          auth:
            username: infisical
            password: "eeb3d0ec1a98f8582253e74b8f22f7ad9f4b56eaf94679aa"
            database: infisicalDB
          primary:
            persistence:
              enabled: true
              storageClass: local-path
              size: 8Gi
        redis:
          enabled: true
          name: redis
          fullnameOverride: redis
          architecture: standalone
          usePassword: true
          auth:
            password: "b10e20323896054ddacbafffa6b3d71b350c826e6ce3e06f"
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true