home-argocd/manifests/passkey-auth.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: pocket-id
  namespace: argocd
spec:
  project: default
  source:
    chart: pocket-id
    repoURL: https://anza-labs.github.io/charts
    targetRevision: 2.2.0
    helm:
      releaseName: pocket-id
      values: |
        replicaCount: 1
        encryptionKey: "nl1YmgXgajp7Op7aTqAQLE+tyUSMKrgMK37j0RxtjXQ="
        host: pass.junv.cc

        database:
          provider: sqlite
          connectionString: "file:data/pocket-id.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(2500)&_txlock=immediate"

        # Probes with generous delays to prevent 503 on restart
        startupProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 5
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 30

        readinessProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 2

        livenessProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 3

        pocketID:
          resources:
            limits:
              cpu: 500m
              memory: 1Gi
            requests:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            runAsUser: 1000

        podSecurityContext:
          fsGroup: 1000
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault

        persistence:
          data:
            enabled: true
            existingClaim: pocket-id-local-pvc
            accessMode: ReadWriteOnce

        ingress:
          enabled: true
          className: nginx
          host: pass.junv.cc
          paths:
          - path: /
            pathType: Prefix
          annotations:
            cert-manager.io/cluster-issuer: letsencrypt-prod
          tls:
          - secretName: pass-junv-cc-tls
            hosts:
            - pass.junv.cc

        nodeSelector:
          kubernetes.io/os: linux

        config:
          ui:
            useDefaults: true

        secret:
          create: false
          name: passkey-auth-secrets

        timeZone: Australia/Sydney
        analyticsDisabled: true
  destination:
    server: https://kubernetes.default.svc
    namespace: nginx-ingress
  syncPolicy:
    retry:
      limit: 1
    automated:
      prune: true
      selfHeal: true