Shared Argo CD templates for self hosted infra

A collection of Argo CD templates for deploying helm apps or directories of Kubernetes (k8s) manifests as Argo CD apps called Smol Apps. We're still working on full stability, but please feel free to ask questions or make suggestions 🧡

These apps were originally designed to be compatible with smol-k8s-lab, but they can be used anywhere :)

Note

This repo is also mirrored to https://codeberg.org/open-engineering/argocd-apps where you can submit Issues and PRs.

Core Tenants

Here's some quick guidelines, but you if you'd like to contribute, please read the full contributing guidelines here 😃!

• Follow a base schema for all our files and directories so that we can easily make more of them faster.

• Make secure as we go to avoid the dreaded all-at-once security pass (but we may have missed something, in which case, please let us know).

• Be kind and if something doesn't work as it should, try to fix the upstream repo before introducing a good-enough fix here.

• NEVER FORGET THE BACKUPS. _{DO YOU REMEMBER WHAT HAPPENED LAST TIME WE DIDN'T HAVE THIS RULE? 😭}

All Smol Apps

• Continuous Deployment
• Chat
  • Experimental
• Backups
• Database and Key Value Stores
  • MySQL
  • PostgreSQL
  • Valkey
• Email
• File Storage
  • Multi-media
  • S3 Compatible
    • Experimental
• Identity Providers and SSO
  • Experimental
• Monitoring
  • Experimental
• Networking
  • Ingress
    • Experimental and Deprecated
  • VPN
• Other
  • Experimental
• Security
  • Experimental
• Secrets Management
  • Experimental and Deprecated
• Social Media
• Virtual Machines
  • Experimental

Continuous Deployment

App Directory	Description
argocd	The one, the only, Argo CD is used for declarative continuous delivery to Kubernetes with a fully-loaded UI. This actually deploys all the other apps and manages itself too :3

Chat

App Directory	Description
coturn	TURN/STUN server for connecting VoIP peers
matrix	matrix is a selfhosted chat server that plugs into a bunch of other chat apps

Experimental

App Directory	Description
element server suite community edition	ESS is the official Element HQ maintained matrix stack, but it's a little behind on things like support for gateway API, so we don't recommend it at this time.

Backups

App Directory	Description
k8up	K8up is a k8s native backups done via restic, so you can sync your persistent volumes to external s3 compliant storage
velero	Verlo is a k8s native backups done via restic, so you can sync your persistent volumes (and volumeSnapshots) to external s3 compliant storage

Database and Key Value Stores

MySQL

We mostly just use the PXC operator at this point.

App Directory	Description
mysql-operator	MySQL database management operator to spin up MySQL clusters, and create backups
percona-pxc-operator	MySQL database management operator to spin up MySQL clusters, and create backups

PostgreSQL

App Directory	Description
cloud-native-postgres	PostgreSQL database management operator to spin up postgres instances, collect metrics, and create backups

Valkey

App Directory	Description
Valkey	Official stand alone Valkey helm chart on k8s. Valkey is a more FOSS alternative to Redis.
Valkey Cluster	ValkeyCluster object. Valkey is a more FOSS alternative to Redis Cluster.
Valkey Operator	Valkey Operator helm chart on k8s. Valkey is a more FOSS alternative to Redis Cluster.

Email

It was only a matter of time before we completed our grey beard metamorphasis and started self-hosting email...

App Directory	Description
Open Engineering Mail Stack	The Open Engineering Mail Stack is a self hosted email suite using traditional tooling like exim/postfix and dovecot. Still in beta
Stalwart	Stalwart is a self hosted email suite. Not currently supported due to lack of production readiness on stalwart's side.

File Storage

App Directory	Description
Collabora Online	Collabora Online is a powerful online document editing suite
harbor	Container Registry and OCI artifact store with built-in vulernability scanning via Trivy
nextcloud	Nextcloud is a self hosted file storage cloud solution. Replaces something like google drive/photos/notes/meets/calendar - mostly stable
Volume Snapshot Controller	Volume Snapshot Controller for taking snapshots of PVCs

Multi-media

App Directory	Description
funkwhale	Funkwhale is kind of like a self hosted spotify. It specializes in audio.
jellyfin	Jellyfin is a home media storage and viewing web app. It specializes in video.

S3 Compatible

App Directory	Description
SeaweedFS	SeaweedFS is a secure and very fast self hosted S3 compatible Object Store specialized for either many files or large files

Experimental

App Directory	Description
garage	Garage is a self hosted S3 compatible Object Store
longhorn	Longhorn is a lightweight, reliable and easy-to-use distributed block storage system for Kubernetes. (not currently actively in development)

Identity Providers and SSO

App Directory	Description
zitadel	helm chart for Zitadel, an Identity Access Management tool with built in OpenIDConnect for authenticating to self hosted apps. Recommended over keycloak.

Experimental

App Directory	Description
keycloak	helm chart for Keycloak, an Identity Access Management tool with built in OpenIDConnect for authenticating to self hosted apps
oauth2-proxy	Oauth2 proxy that works with Google, however we're testing a keycloak provider right now
vouch-proxy	helm chart for Vouch, an OAuth2 proxy that allows you to use ingress-nginx annotations to connect to a third party identity provider, giving you proper auth on websites that don't have auth. Currently works with the zitadel provider in this template, but also known to work with keycloak, google, and github. Deprecated as we don't use ingress-nginx anymore.

Monitoring

App Directory	Description
alloy	Alloy for collecting metrics, logs, and traces. We also bundle kube-state-metrics and cadvisor in this smol-app. Alloy forwards all it's data to our LGTM Stack.
LGTM Stack	Loki, Grafana, Tempo, Mimir for aggregating and visualizing metrics, logs, and traces for monitoring/alerting, and dashboards.
prometheus-push-gateway	Installs the Prometheus Push Gateway which enables pushing metrics from jobs that would be difficult or impossible to scrape

Experimental

App Directory	Description
kepler	helm chart for Kepler, (Kubernetes-based Efficient Power Level Exporter), which uses eBPF to probe performance counters and other system stats, use ML models to estimate workload energy consumption based on these stats, and exports them as Prometheus metrics.

Networking

App Directory	Description
metallb	A helm chart for metallb which will let you manager your own ip address pool for use with ingress

Ingress

App Directory	Description
cert-manager	helm chart for cert-manager, for providing TLS certificates based on nginx ingress annotations
traefik	helm chart for traefik, an ingress controller to allow external traffic to the cluster

Experimental and Deprecated

App Directory	Description
cilium	A helm chart for cilium, for transparently securing network connectivity/loadbalancing b/w app workloads such as app containers or processes
ingress-nginx	helm chart for ingress-nginx, an nginx ingress controller to allow external traffic to the cluster (now Deprecated and slowly being phased out in favor of traefik)

VPN

App Directory	Description
headscale	VPN, there isn't an official helm chart, so we're still working on this
wireguard	A helm chart for wg-access-server which uses Wireguard®️ for a VPN

Other

Other useful tools that don't fit neatly into any one category.

Experimental

App Directory	Description
k8tz	A helm chart for k8tz, to inject timezone info into cronjob pods
LibreTranslate	A helm chart for LibreTranslate, to self host a translation tool

Security

App Directory	Description
kyverno	Kubernetes-native policy management

Experimental

App Directory	Description
opa	Open Policy Agent Gatekeeper

Secrets Management

App Directory	Description
external-secrets-operator	ESO (External Secrets Operator) used for sourcing k8s secrets from an external provider
openbao	OpenBao is an open source secrets management solution forked from Vault and supported by the Linux Foundation. It works great with ESO and is what we'll be transitioning all our apps to use going forward.

Experimental and Deprecated

App Directory	Description
infisical	Infisical is an open source secrets management solution and it has a k8s secrets operator. We demoed it, but never really used it much.

Social Media

App Directory	Description
ghost	Ghost is a selfhosted blogging platform.
gotosocial	GoToSocial is a selfhosted social media site, includes postgresql. Advertised as lighter weight in requirements than Mastodon.
mastodon	Mastodon is a selfhosted social media site, includes postgresql, elastic search (for full text searching), and valkey (in memory caching)
peertube	PeerTube is a selfhosted video hosting website that acts a replacement for YouTube. This app of apps includes postgresql, valkey, and S3 (via SeaweedFS).
writefreely	WriteFreely is a slim selfhosted blogging platform.

Virtual Machines

App Directory	Description
kubevirt	KubeVirt is a virtual machine management add-on for Kubernetes.

Experimental

App Directory	Description
Nvidia GPU Operator	The GPU Operator allows administrators of Kubernetes clusters to manage GPU nodes

All Smol Plugins

These are used for generating specific objects and components related to smol-apps. Read more in the smol-plugins README.

Troubleshooting Tips

• Namespace stuck in terminating state

  kubectl get namespace "<NAMESPACE>" -o json   | tr -d "\n" | sed "s/\"finalizers\": \[[^]]\+\]/\"finalizers\": []/"   | kubectl replace --raw /api/v1/<NAMESPACE>/cdi/finalize -f -
  

• Find all items in a namespace

  kubectl api-resources --verbs=list --namespaced -o name   | xargs -n 1 kubectl get --show-kind --ignore-not-found -n <NAMESPACE>
  

• be sure to check for and remove Mutatingwebhookconfiguration and Validatingwebhookconfiguration

• Patching a resource you found via the Xargs search

  kubectl patch <CLASS>/<NAME>-p '{"metadata":{"finalizers":[]}}' --type=merge -n <NAMESPACE>