Added certmanager

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/copilot-instructions.md

@@ -130,6 +130,7 @@ Before proposing deploy commands, check whether the change targets the host Comp
 - Before editing a chart's `values.yaml`, check the schema for the exact chart/dependency version declared in its `Chart.yaml`. Prefer a schema shipped with that exact chart package; never use a schema from `main`, `latest`, or a different version as if it were authoritative.
 - Current chart schema/reference locations:
   - Cilium: `infrastructure/cilium/Chart.yaml` pins the Cilium dependency. Its matching upstream schema is [`values.schema.json` for Cilium v1.17.6](https://raw.githubusercontent.com/cilium/cilium/v1.17.6/install/kubernetes/cilium/values.schema.json). Keep this reference aligned with the dependency version when upgrading.
+  - cert-manager: `infrastructure/cert-manager/Chart.yaml` pins the Jetstack cert-manager chart. Its matching upstream schema is [`values.schema.json` for cert-manager v1.21.2](https://raw.githubusercontent.com/cert-manager/cert-manager/v1.21.2/deploy/charts/cert-manager/values.schema.json). Keep this reference aligned with the dependency version when upgrading; cert-manager's CRDs are enabled and retained by this chart.
   - Longhorn: `infrastructure/longhorn/Chart.yaml` pins the Longhorn dependency. The matching [v1.8.1 chart directory](https://github.com/longhorn/longhorn/tree/v1.8.1/chart) does not include `values.schema.json`; use that release's [`values.yaml`](https://raw.githubusercontent.com/longhorn/longhorn/v1.8.1/chart/values.yaml) and chart documentation alongside this repository's values and templates. Do not substitute a schema from another Longhorn release.
   - Vaultwarden: this is a repository-maintained chart under `services/vaultwarden/`, not an upstream chart dependency, and it currently has no `values.schema.json`. Use the [Gabe565 Vaultwarden chart values](https://github.com/gabe565/charts/blob/main/charts/vaultwarden/values.yaml) as a reference for upstream configuration options, but treat this repository's `services/vaultwarden/values.yaml` and templates as the actual contract. The upstream chart has its own structure and common-library dependency, so do not copy its values or assume they work here without checking the local templates. If changing or adding local chart values, add or update `services/vaultwarden/values.schema.json` to validate the local contract.
 - Pin versions for deployed software and build/deployment dependencies. Avoid `latest`, floating tags, and unversioned references; for container images, use an explicit version tag and prefer a digest where practical for immutable deployments. If a floating reference is necessary, explain why and its update risk.

README.md

@@ -39,7 +39,7 @@ flowchart LR
 
   subgraph gitops[GitOps repository directories]
     appsetFiles[bootstrap/applicationsets]
-    infra[infrastructure/*<br/>Cilium and Longhorn charts]
+    infra[infrastructure/*<br/>Cilium, cert-manager, and Longhorn charts]
     services[services/*<br/>Vaultwarden and other charts]
     appsetFiles -. registers .-> appsets
     infra --> apps
@@ -204,9 +204,11 @@ The Kubernetes path accepts a `nodes` list containing any number of control-plan
   kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d
   ```
 
-11. Confirm Argo CD discovers `infrastructure/cilium`, `infrastructure/longhorn`, and `services/vaultwarden`, and that the Longhorn StorageClass is available before relying on Vaultwarden persistence.
+11. Confirm Argo CD discovers `infrastructure/cilium`, `infrastructure/cert-manager`, `infrastructure/longhorn`, and `services/vaultwarden`, and that the Longhorn StorageClass is available before relying on Vaultwarden persistence.
 
-Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Cilium's Envoy ingress controller is enabled in shared-load-balancer mode; Ingress resources must set `spec.ingressClassName: cilium`. The Cilium LoadBalancer IP pool is `10.0.0.10–10.0.0.89`, announced over `enp1s0` with an L2 announcement policy. Keep that range reserved from DHCP and other static assignments, and recheck the interface and pool if the node network changes. Longhorn also requires a validated disk or mount on the storage node.
+Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Cilium's Envoy ingress controller is enabled in shared-load-balancer mode; Ingress resources must set `spec.ingressClassName: cilium`. The Cilium LoadBalancer IP pool is configured in `infrastructure/cilium/templates/loadbalancer-ippool.yaml` and announced over `enp1s0` with an L2 announcement policy. Keep the configured range reserved from DHCP and other static assignments, and recheck the interface and pool if the node network changes.
+
+cert-manager is installed from the pinned Jetstack chart under `infrastructure/cert-manager/`, with its CRDs enabled and retained on uninstall. This installs the certificate controller but does not create an Issuer, ClusterIssuer, or application Certificates; configure those resources and any required DNS or ACME account settings before requesting certificates. The chart version is pinned in `infrastructure/cert-manager/Chart.yaml`; use the matching [cert-manager v1.21.2 values schema](https://raw.githubusercontent.com/cert-manager/cert-manager/v1.21.2/deploy/charts/cert-manager/values.schema.json) and [Helm installation documentation](https://cert-manager.io/docs/installation/helm/) when changing chart values. Longhorn also requires a validated disk or mount on the storage node.
 
 The Terraform Talos provider uses one generated machine-secrets bundle for the whole node list. If the nodes were previously configured with another Talos CA, reset/reinstall them or restore the matching Terraform state before applying. Terraform state contains the generated Talos credentials and must remain private.
 

infrastructure/cert-manager/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: cert-manager
+  repository: oci://quay.io/jetstack/charts
+  version: v1.21.2
+digest: sha256:76871d34668a844055ed19c78b9fd543d1fa061946a52360faf05282360e4fb3
+generated: "2026-10-09T13:17:54.794093438-06:00"

infrastructure/cert-manager/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: cert-manager-infrastructure
+description: cert-manager installation and configuration for the home-services cluster.
+type: application
+version: 0.1.0
+appVersion: "v1.21.2"
+dependencies:
+  - name: cert-manager
+    version: v1.21.2
+    repository: oci://quay.io/jetstack/charts

infrastructure/cert-manager/values.yaml

@@ -0,0 +1,4 @@
+cert-manager:
+  crds:
+    enabled: true
+    keep: true

infrastructure/cilium/templates/l2-announcement-policy.yaml

@@ -2,8 +2,6 @@ apiVersion: cilium.io/v2alpha1
 kind: CiliumL2AnnouncementPolicy
 metadata:
   name: loadbalancer-services
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
 spec:
   interfaces:
     - "^enp1s0$"

infrastructure/cilium/templates/loadbalancer-ippool.yaml

@@ -2,8 +2,6 @@ apiVersion: cilium.io/v2alpha1
 kind: CiliumLoadBalancerIPPool
 metadata:
   name: home-services
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
 spec:
   blocks:
     - start: 10.0.0.10

infrastructure/cilium/values.yaml

@@ -47,6 +47,8 @@ cilium:
     enabled: true
     default: false
     loadbalancerMode: shared
+    service:
+      allocateLoadBalancerNodePorts: false
 
   operator:
     replicas: 1