infcloud added. davical additional ingress at c2.aggtaa.com

clusters/base/apps/davical/helmrelease-davical.yaml

@@ -90,6 +90,11 @@ spec:
         # No stripPrefix middleware either: Apache needs to see the /server
         # prefix itself (via the Alias added in the seed-config initContainer)
         # so that DAViCal's self-referential links come out correct.
+        #
+        # c2.aggtaa.com/server is the same backend, reachable same-origin
+        # from InfCloud (also on c2.aggtaa.com) so its browser-side CalDAV
+        # requests don't need CORS. That ingress owns the cert-manager
+        # annotation for c2.aggtaa.com; this one just reuses its secret.
         hosts:
           - host: c.aggtaa.com
             paths:
@@ -98,10 +103,20 @@ spec:
                 service:
                   identifier: app
                   port: http
+          - host: c2.aggtaa.com
+            paths:
+              - path: /server
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
         tls:
           - secretName: radicale-tls
             hosts:
               - c.aggtaa.com
+          - secretName: infcloud-tls
+            hosts:
+              - c2.aggtaa.com
 
     persistence:
       config:

clusters/base/apps/infcloud/helmrelease-infcloud.yaml

@@ -0,0 +1,62 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: infcloud
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: infcloud
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      infcloud:
+        containers:
+          app:
+            image:
+              repository: waja/infcloud
+              tag: "0.13.1-16"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: infcloud
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        # this ingress owns the cert-manager request for c2.aggtaa.com;
+        # davical's ingress adds a second host on the same domain (for the
+        # /server CalDAV path) and just references the secret below.
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: c2.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: infcloud-tls
+            hosts:
+              - c2.aggtaa.com
+
+    persistence:
+      config:
+        type: configMap
+        name: infcloud-config
+        globalMounts:
+          - path: /srv/infcloud/config/config.js
+            subPath: config.js
+            readOnly: true

clusters/base/apps/infcloud/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: infcloud
+  namespace: pim
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/infcloud/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease-infcloud.yaml

clusters/home/apps/infcloud.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: infcloud
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/infcloud
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/home/apps/kustomization.yaml

@@ -12,4 +12,5 @@ resources:
   - markdown-vault-mcp.yaml
   - nfs-ganesha.yaml
   - webdav.yaml
-  - fava.yaml
+  - fava.yaml
+  - infcloud.yaml