HOMELAB-954: feat(workadventure): add base values, HTTPRoute, ExternalSecret #176

Merged

aaron merged 1 commit from plane/HOMELAB-954-workadventure into live

2026-04-19 17:55:38 +00:00

aaron commented

2026-04-19 05:31:53 +00:00

Owner

Summary

Infra-core side of the WorkAdventure deploy (Plane: HOMELAB-954). Companion PR in prod adds the ArgoCD Applications and env overrides; this PR carries:

core/charts/apps/workadventure/values.yaml — base Helm values for upstream workadventure/workadventure v1.30.5 (singleDomain, bundled Redis + Longhorn PVC, Longhorn map-storage PVC, root ingress disabled, externalSecretName wired on play/back/uploader/mapstorage).
core/manifests/apps/workadventure/httproute.yaml — HTTPRoute on homelab-gateway (cilium-system), single host play.aaron.reynoza.org. Path rules mirror the chart's nginx Ingress: /api, /uploader, /icon, /map-storage (each with prefix-rewrite to /), /ws (websocket pusher), / (front).
core/manifests/apps/workadventure/eso.yaml — ExternalSecret pulling workadventure_map_storage_api_token and workadventure_map_storage_password from the shared app-credentials Secret in the secrets namespace, materialised as workadventure-credentials in the workadventure namespace.

File naming: eso.yaml (not externalsecret.yaml) avoids a false-positive in the pre-commit-checks.sh SOPS check that triggers on the substring secret in any filename.

Plan

docs/superpowers/plans/2026-04-19-workadventure-hubs-eval.md (in simple-harness)

Pre-merge prerequisite

Add these two keys to prod/secrets/app-credentials.yaml and re-encrypt with SOPS — the ExternalSecret will fail until they exist:

workadventure_map_storage_api_token: <40-char random>
workadventure_map_storage_password:  <40-char random>

Test plan

ArgoCD picks up companion workadventure + workadventure-manifests Apps from the prod PR
Both Apps reach Synced + Healthy
https://play.aaron.reynoza.org loads the WA front page over the wildcard cert
Two browsers on LAN see each other's avatars and trigger proximity voice chat
A custom map uploaded via /map-storage/ admin survives a pod restart
No manually-applied Secrets in the workadventure namespace; all from ESO

## Summary Infra-core side of the WorkAdventure deploy (Plane: HOMELAB-954). Companion PR in `prod` adds the ArgoCD Applications and env overrides; this PR carries: - `core/charts/apps/workadventure/values.yaml` — base Helm values for upstream `workadventure/workadventure` v1.30.5 (singleDomain, bundled Redis + Longhorn PVC, Longhorn map-storage PVC, root ingress disabled, `externalSecretName` wired on play/back/uploader/mapstorage). - `core/manifests/apps/workadventure/httproute.yaml` — HTTPRoute on `homelab-gateway` (`cilium-system`), single host `play.aaron.reynoza.org`. Path rules mirror the chart's nginx Ingress: `/api`, `/uploader`, `/icon`, `/map-storage` (each with prefix-rewrite to `/`), `/ws` (websocket pusher), `/` (front). - `core/manifests/apps/workadventure/eso.yaml` — ExternalSecret pulling `workadventure_map_storage_api_token` and `workadventure_map_storage_password` from the shared `app-credentials` Secret in the `secrets` namespace, materialised as `workadventure-credentials` in the `workadventure` namespace. File naming: `eso.yaml` (not `externalsecret.yaml`) avoids a false-positive in the `pre-commit-checks.sh` SOPS check that triggers on the substring `secret` in any filename. ## Plan docs/superpowers/plans/2026-04-19-workadventure-hubs-eval.md (in simple-harness) ## Pre-merge prerequisite Add these two keys to `prod/secrets/app-credentials.yaml` and re-encrypt with SOPS — the ExternalSecret will fail until they exist: ``` workadventure_map_storage_api_token: <40-char random> workadventure_map_storage_password: <40-char random> ``` ## Test plan - [ ] ArgoCD picks up companion `workadventure` + `workadventure-manifests` Apps from the `prod` PR - [ ] Both Apps reach Synced + Healthy - [ ] `https://play.aaron.reynoza.org` loads the WA front page over the wildcard cert - [ ] Two browsers on LAN see each other's avatars and trigger proximity voice chat - [ ] A custom map uploaded via `/map-storage/` admin survives a pod restart - [ ] No manually-applied Secrets in the `workadventure` namespace; all from ESO

aaron added 1 commit

2026-04-19 05:31:53 +00:00

HOMELAB-954: feat(workadventure): add base values, HTTPRoute, ExternalSecret

0/0 projects applied successfully.

Lint & Validate / terraform-validate (pull_request) Has been cancelled

Details

Lint & Validate / yaml-lint (pull_request) Has been cancelled

Details

Lint & Validate / shellcheck (pull_request) Has been cancelled

Details

CI Review / pr-title (pull_request) Has been cancelled

Details

CI Review / helm-validate (pull_request) Has been cancelled

Details

CI Review / ai-review (pull_request) Has been cancelled

Details

4de42e7f73

Adds the infra-core side of the WorkAdventure deploy:
- core/charts/apps/workadventure/values.yaml: base Helm values for the
  upstream workadventure/workadventure v1.30.5 chart (singleDomain,
  bundled Redis + Longhorn PVC, mapstorage Longhorn PVC, root ingress
  disabled in favour of a sibling HTTPRoute, externalSecretName wired
  to ESO-managed Secret).
- core/manifests/apps/workadventure/httproute.yaml: HTTPRoute on
  homelab-gateway (cilium-system), single host play.aaron.reynoza.org,
  path rules mirroring the chart's nginx Ingress (/api, /uploader,
  /icon, /map-storage, /ws, /).
- core/manifests/apps/workadventure/eso.yaml: ExternalSecret pulling
  workadventure_map_storage_api_token + workadventure_map_storage_password
  from the shared app-credentials Secret in the secrets namespace.

Companion ArgoCD Applications + env overrides ship in the prod repo.

Plan: docs/superpowers/plans/2026-04-19-workadventure-hubs-eval.md