feat(couchdb): deploy CouchDB for Obsidian sync (communicore)

cluster/applications/couchdb/values.yaml

@@ -0,0 +1,89 @@
+# CouchDB Helm Chart Values
+# Application: couchdb
+# Theme: communicore (DNS only)
+# Purpose: Obsidian sync backend for mk-labs
+
+# Cluster configuration
+clusterSize: 1  # Single node for homelab
+
+# Admin credentials managed via ExternalSecret
+# See externalsecret.yaml for 1Password integration
+createAdminSecret: false
+extraSecretName: "couchdb-admin"
+adminUsernameKey: "adminUsername"
+adminPasswordKey: "adminPassword"
+cookieAuthSecretKey: "cookieAuthSecret"
+
+# Auto-setup cluster after installation
+autoSetup:
+  enabled: true
+  image:
+    repository: curlimages/curl
+    tag: "8.11.1"  # Pinned version
+    pullPolicy: IfNotPresent
+  defaultDatabases:
+    - _global_changes
+
+# Network policy for pod communication
+networkPolicy:
+  enabled: true
+
+# Service account
+serviceAccount:
+  enabled: true
+  create: true
+
+# Persistent storage
+persistentVolume:
+  enabled: true
+  accessModes:
+    - ReadWriteOnce
+  size: 20Gi
+  storageClass: "nfs-emporium"
+
+# CouchDB image - pinned version
+image:
+  repository: couchdb
+  tag: "3.5.1"
+  pullPolicy: IfNotPresent
+
+# Service configuration
+service:
+  enabled: true
+  type: ClusterIP
+  port: 5984
+
+# Ingress configuration
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-staging"  # Start with staging
+    external-dns.alpha.kubernetes.io/hostname: "communicore.mk-labs.cloud"
+  hosts:
+    - communicore.mk-labs.cloud
+  tls:
+    - secretName: couchdb-tls
+      hosts:
+        - communicore.mk-labs.cloud
+
+# Resource limits
+resources:
+  requests:
+    cpu: 100m
+    memory: 512Mi
+  limits:
+    cpu: 1000m
+    memory: 2Gi
+
+# CouchDB configuration
+couchdbConfig:
+  couchdb:
+    uuid: "decafbaddecafbaddecafbaddecafbad"  # Will be regenerated on first run
+  chttpd:
+    bind_address: "0.0.0.0"
+    port: 5984
+    require_valid_user: true
+  httpd:
+    bind_address: "0.0.0.0"
+    port: 5986