# ============================================================================
# ArgoCD Application: LiteLLM proxy (skyliner)
# Wave: 8 (same tier as hindsight / openviking)
# Deployment method: GitOps (Gitea -> ArgoCD)
# ============================================================================
#
# Multi-source: upstream OCI Helm chart (pinned) + local values + manifests
# from repo (namespace, ExternalSecrets, HTTPRoute, ExternalName Services,
# ServiceMonitor). Follows the openviking / hindsight pattern.
#
# Chart: oci://ghcr.io/berriai/litellm-helm  (version == appVersion)
# Includes bundled Bitnami PostgreSQL (db.deployStandalone: true).
#
# NOTE (ArgoCD + OCI): repoURL has NO "oci://" prefix. If the OCI registry is not
# already usable by ArgoCD, register it once (public repo, no creds needed):
#   argocd repo add ghcr.io/berriai --type helm --name berriai-oci --enable-oci
#
# Platform changes required BEFORE this syncs (see DEPLOYMENT GATE below).
# ============================================================================
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: litellm
  namespace: argocd
  labels:
    app.kubernetes.io/name: litellm
    app.kubernetes.io/part-of: mk-labs
  annotations:
    argocd.argoproj.io/sync-wave: "8"
    description: |
      LiteLLM OpenAI-compatible gateway for Paperclip/OpenCode and Hermes agents.
      Host: skyliner.wdw-labs.cloud (fastpass-gateway, HTTPRoute). Admin UI at /ui.
      Backends: illuminations vLLM (Gemma-4-26B); Mac Studio (fantasmic) and
      Mac Mini (wishes) as placeholders.
spec:
  project: default

  sources:
    # Source 1: upstream OCI Helm chart, pinned
    - repoURL: ghcr.io/berriai
      chart: litellm-helm
      targetRevision: 1.106.1
      helm:
        releaseName: litellm
        valueFiles:
          - $values/cluster/applications/litellm/values.yaml

    # Source 2: homelab repo — values ref + manifests
    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
      targetRevision: main
      path: cluster/applications/litellm
      ref: values
      directory:
        # Not Kubernetes manifests
        exclude: "{application.yaml,values.yaml}"

  destination:
    server: https://kubernetes.default.svc
    namespace: litellm

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true

# ============================================================================
# DEPLOYMENT GATE: DO NOT MERGE/SYNC UNTIL
# ============================================================================
# 1. 1Password vault wdw-labs has item "litellm" (master-key, salt-key, db-password,
#    db-admin-password) and items "illuminations", "fantasmic",
#    "wishes" (field "api-key"); the onepassword-connect token can read
#    wdw-labs and the ClusterSecretStore lists it (platform/onepassword-connect).
#    (master-key must start with "sk-"; salt-key is PERMANENT — never rotate it
#    after models/keys are stored, or stored credentials become undecryptable).
# 2. Platform changes are live: cert-manager dnsZones (wdw-labs.cloud), gateway
#    listener + skyliner Certificate, ReferenceGrant for litellm, and external-dns
#    (Technitium) can write to the wdw-labs.cloud zone (zone exists + TSIG key
#    authorized for it).
# 3. DNS names fantasmic.wdw-labs.cloud / wishes.wdw-labs.cloud resolve from pods.
# 4. Verified with `helm template` (see README / hand-off notes).
# ============================================================================