{"id":29416338,"url":"https://github.com/sean-njela/k8s_app_template","last_synced_at":"2026-05-11T07:40:12.843Z","repository":{"id":301948753,"uuid":"1010743714","full_name":"sean-njela/k8s_app_template","owner":"sean-njela","description":"Universal K8s template – from local k3s to GKE Autopilot, with dev/staging/prod pipelines powered by Terraform, Helmfile, Argo CD, GitHub Actions, Devbox + Mise, and full security/observability tooling.","archived":false,"fork":false,"pushed_at":"2025-06-29T18:28:08.000Z","size":36,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-06-29T19:32:00.733Z","etag":null,"topics":["ci-cd","cloud-native","devbox","devsecops","github-actions","gitops","gke","gke-autopilot","helm","k3d","kubernetes","linkerd","service-mesh","solo-developer","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sean-njela.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-06-29T17:59:12.000Z","updated_at":"2025-06-29T18:28:11.000Z","dependencies_parsed_at":"2025-06-29T19:42:23.751Z","dependency_job_id":null,"html_url":"https://github.com/sean-njela/k8s_app_template","commit_stats":null,"previous_names":["sean-njela/k8s_app_template"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sean-njela/k8s_app_template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sean-njela%2Fk8s_app_template","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sean-njela%2Fk8s_app_template/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sean-njela%2Fk8s_app_template/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sean-njela%2Fk8s_app_template/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sean-njela","download_url":"https://codeload.github.com/sean-njela/k8s_app_template/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sean-njela%2Fk8s_app_template/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264878580,"owners_count":23677451,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ci-cd","cloud-native","devbox","devsecops","github-actions","gitops","gke","gke-autopilot","helm","k3d","kubernetes","linkerd","service-mesh","solo-developer","terraform"],"created_at":"2025-07-11T19:02:58.755Z","updated_at":"2026-05-11T07:40:07.820Z","avatar_url":"https://github.com/sean-njela.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🚀 Solo‑Dev Kubernetes Platform Starter\n\nA **turn‑key Dev ➜ Prod stack** for web applications that scales from a single‑node k3s on your laptop to Google GKE Autopilot in production—fully reproducible with **Terraform**, **Helm/Helmfile**, and **Argo CD**.\n\n\u003e ✨ Everything is automated. If you can run `git push`, you can ship to prod.\n\n---\n\n## 📁 Repository layout (top‑level)\n\n```\n.\n├── bootstrap/           # Argo CD root + addon Applications\n├── charts/              # Reusable Helm chart(s)\n├── clusters/            # Env‑specific Helmfile releases (staging / prod)\n├── dev/                 # Tilt + local values for k3s\n├── docs/                # Deep‑dive docs \u0026 runbooks\n├── infra/               # Terraform roots (staging / prod GKE)\n├── scripts/             # Helper scripts (bootstrap, deploy, k3d init)\n├── .github/workflows/   # CI (build) • CD (deploy) • IaC (infra)\n├── Taskfile.yml         # One‑liner commands (`task -l`)\n├── devbox.json          # Pure CLI toolchain via Nix\n├── .mise.toml           # Language runtimes (Node, Go, Python)\n└── README.md            # ← you are here\n```\n\n---\n\n## 🖥️  Quick start for contributors\n\n```bash\n# 1. Clone \u0026 enter reproducible shell (installs CLIs via Nix)\n$ devbox shell\n\n# 2. Install language runtimes (Node 20, Go 1.22, Python 3.12)\n$ mise install\n\n# 3. Spin up local k3s cluster + live‑reload dev loop\n$ task dev:up             # creates k3d cluster \u0026 opens Tilt dashboard\n\n# 4. Browse app at http://localhost:8080 (auto reload on save)\n```\n\n*To clean up, run `task dev:down`.*\n\n---\n\n## 🏗️  Provision cloud infrastructure\n\n```bash\n# Bootstrap Terraform state manually once (see infra/*/backend.tf)\n# Then provision staging GKE Autopilot cluster\n$ task tf:plan ENV=staging\n$ task tf:apply ENV=staging\n\n# (Prod requires PR + approval / GitHub Environment gate)\n```\n\nTerraform plans \u0026 applies can also be triggered via **GitHub Actions ➜ \"Terraform‑Infra\"** workflow.\n\n---\n\n## 🔄 CI / CD flow (GitHub Actions ✚ Argo CD)\n\n1. **Push to `main`** → `build.yml` tests, builds, scans, and pushes a multi‑arch container image.\n2. `deploy.yml` opens an **auto‑PR** that bumps the image tag in `clusters/staging` values.\n3. Merge the PR → Argo CD syncs staging.\n4. Validate staging → promote to prod via a protected PR (`task deploy:prod` or merge the prod PR).\n\n\u003cdetails\u003e\n\u003csummary\u003eMermaid diagram\u003c/summary\u003e\n\n```mermaid\ngraph TD\n  A[Commit → main] --\u003e B(CI Build \u0026 Scan)\n  B --\u003e C(Image registry: GHCR)\n  B --\u003e D(PR: bump staging tag)\n  D --\u003e|merge| E(Argo CD sync staging)\n  E --\u003e F(Verify)\n  F --\u003e G[PR: bump prod tag]\n  G --\u003e|merge| H(Argo CD sync prod)\n```\n\n\u003c/details\u003e\n\n---\n\n## ⚙️  Common Taskfile commands\n\n| Command                        | What it does                                          |\n| ------------------------------ | ----------------------------------------------------- |\n| `task k3s:init`                | Create local k3d cluster (`k3s-dev`)                  |\n| `task dev:up` / `dev:down`     | Start/stop Tilt live reload                           |\n| `task build:image`             | Build \u0026 push multi‑arch image (uses Buildx)           |\n| `task scan:trivy`              | CVE scan the image                                    |\n| `task deploy:staging`          | Deploy current `IMAGE_TAG` to staging via Helmfile    |\n| `task rollback:prod TAG=\u003csha\u003e` | Roll back production to previous image                |\n| `task bootstrap:cluster`       | Install Argo CD \u0026 app‑of‑apps on current kube‑context |\n\n\u003e Run **`task -l`** to list *all* tasks.\n\n---\n\n## 🛠️  Adding a new micro‑service\n\n1. Duplicate `values-examples/nodejs.yaml` (or Django/Golang…) into `clusters/staging/values/`.\n2. Add a release entry in `clusters/staging/helmfile.yaml` → point to `charts/webapp-template`.\n3. Commit \u0026 push — CI will bump image tag automatically.\n4. Promote to prod via the same GitOps PR flow.\n\n---\n\n## 🆘  Troubleshooting\n\n| Problem                    | Where to look                                                   |\n| -------------------------- | --------------------------------------------------------------- |\n| **Pods CrashLoop**         | `kubectl logs`, check ExternalSecrets values (Infisical)        |\n| **Ingress 404**            | `kubectl describe ingress \u003cname\u003e` or Traefik dashboard          |\n| **HPA not scaling in dev** | Autoscaling disabled in `dev/values-local.yaml`                 |\n| **Terraform failure**      | GitHub Actions ➜ Terraform‑Infra logs / or local `task tf:plan` |\n\nDetailed runbooks live under **`docs/runbooks/`**.\n\n\n---\n## For Self Hosting Open Source Software \n\n### Short answer\n\n**The stack is already well-suited for self-hosting open-source applications** (think Nextcloud, Gitea, Plausible, Mastodon, etc.). Nothing fundamental must change; you mainly decide ***how*** you bring each app in:\n\n1. **Use their official Helm chart**\n   *Most OSS projects expose one.*\n\n   * Add a new `bootstrap/argocd/applications/\u003capp\u003e.yaml` that points to the public chart repo and version you want.\n   * Keep it in the same *addons* AppProject, or create a separate AppProject if you want tighter RBAC.\n\n2. **Wrap the upstream container in your `webapp-template` chart**\n   *Great when the project ships only raw images or docker-compose.*\n\n   * Drop the image/tag into `clusters/*/values/\u003capp\u003e-values.yaml`.\n   * Use your own `Ingress`, `HPA`, `ExternalSecret` blocks instead of whatever their compose file suggests.\n\n3. **Fork \u0026 harden**\n\n   * Build the image yourself via the **`build.yml`** pipeline (so Trivy \u0026 Cosign sign/scan it).\n   * Swap to `REGISTRY=ghcr.io/\u003cyou\u003e` in the app values.\n\n---\n\n### What to keep in mind\n\n| Area                     | Tips for self-hosting OSS apps                                                                                                                                |\n| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| **Licensing**            | Some AGPL apps require that you publish *your* source if you modify them. Keep a LICENSE or NOTICE file in the repo when needed.                              |\n| **Container provenance** | Prefer building your own image in CI → you get SBOM and Cosign signature automatically.                                                                       |\n| **Secrets**              | Many community charts still use plain `values.yaml` for passwords. Route those through **Infisical** + `ExternalSecret` so they stay out of Git.              |\n| **Storage**              | A lot of self-hosted tools need PVCs (Nextcloud, databases). GKE Autopilot supports RWX Filestore CSI; add a `storageClassName` override in the app’s values. |\n| **Ingress**              | Your Traefik chart already handles Let’s Encrypt. Map each app’s sub-domain in its values file (staging \u0026 prod).                                              |\n| **Resource limits**      | Open-source images often have none. Set reasonable requests/limits in their per-env values to avoid OOMs.                                                     |\n| **Back-ups**             | Velero is in your addons list—make sure to add each PersistentVolumeClaim to the Velero schedule (label selector).                                            |\n| **Upgrade cadence**      | Pin explicit chart/image versions in every `Application`; renovate-bot or Dependabot can later bump them via PRs.                                             |\n\n---\n\n### Example: adding Gitea (lightweight Git server)\n\n1. **Add repo to allowed list**\n\n```yaml\n# bootstrap/argocd/projects/default.yaml\nspec:\n  sourceRepos:\n    - https://dl.gitea.io/charts/\n```\n\n2. **Create the Argo CD Application**\n\n```yaml\n# bootstrap/argocd/applications/gitea.yaml\napiVersion: argoproj.io/v1alpha1\nkind: Application\nmetadata:\n  name: gitea\n  namespace: argocd\nspec:\n  project: default\n  destination:\n    server: https://kubernetes.default.svc\n    namespace: gitea\n  source:\n    repoURL: https://dl.gitea.io/charts/\n    chart: gitea\n    targetRevision: 10.2.3\n    helm:\n      values: |\n        ingress:\n          enabled: true\n          hosts:\n            - host: git.example.com\n              paths: [\"/\"]\n        postgresql:\n          enabled: false              # use CloudSQL or AlloyDB\n  syncPolicy:\n    automated:\n      prune: true\n      selfHeal: true\n    syncOptions: [CreateNamespace=true]\n```\n\n3. **Commit → Argo CD syncs**.\n   The app rides on the same observability, TLS, autoscaling, and backup tooling you already have.\n\n---\n\n### Bottom-line\n\n*Your platform already covers the heavy lifting — CI scanning, GitOps deployment, TLS, secrets, backups, autoscaling.*\nSelf-hosting an open-source project is now just:\n\n```bash\n# 1. Add or wrap a Helm chart\ngit add bootstrap/argocd/applications/\u003capp\u003e.yaml\ngit commit -m \"feat: self-host \u003capp\u003e\"\ngit push\n# 2. Watch Argo CD turn it green 🚦\n```\n\nIf you run into a specific OSS app that doesn’t “just drop in,” let us know and we can adapt the template.\n\n---\n\n## 🙋 FAQ\n\n* **Why GKE Autopilot?** Zero node management; Google handles upgrades \u0026 security patches.\n* **Why k3d instead of minikube?** Faster, Docker‑native, matches k3s used in edge devices.\n* **Why Devbox *and* Mise?** Devbox gives an instant Nix shell of CLI tools; Mise pins language runtimes IDEs rely on.\n* **Can I use AWS/EKS instead?** Yes—swap the Terraform modules for `terraform-aws-modules` equivalents and tweak the clusters/ configs.\n\n---\n\n## 🤝 Contributing\n\nPRs are welcome! Please run local `task lint:yaml` and `task lint:helm` before opening a pull request, and ensure `build.yml` passes.\n\n---\n\n## License\n\nMIT. See `LICENSE` file for details.\n\n\u003cdiv align=\"center\"\u003e\n  \u003csub\u003eHappy shipping! 🚢\u003c/sub\u003e\n\u003c/div\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsean-njela%2Fk8s_app_template","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsean-njela%2Fk8s_app_template","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsean-njela%2Fk8s_app_template/lists"}