commit cf03e8e0e9a1025a60a803e713039feb8983a168
Author: darren <darrenmaverickz@gmail.com>
Date:   Sun Jul 19 02:33:48 2026 +0700

    initial push

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..753f307
--- /dev/null
+++ b/README.md
@@ -0,0 +1,38 @@
+# k3s-manifests
+
+Desired-state repo for the k3s cluster. **ArgoCD watches this repo and makes the
+cluster match it.** You deploy by committing here; you roll back with `git revert`.
+Do not `kubectl apply` these by hand — let ArgoCD own them.
+
+## Structure
+
+```
+apps/                    # app-of-apps: one ArgoCD Application per service/env
+  gitops-demo.yaml       #   -> points at gitops-demo/dev
+gitops-demo/             # a service
+  dev/                   #   its dev environment (plain k8s YAML)
+    deployment.yaml
+    service.yaml
+    ingress.yaml
+```
+
+Environment is a folder (`dev`, later `prod`). The manifests are **plain YAML on
+purpose** for now — Phase 4 replaces the per-env duplication with a generic Helm
+chart. One new concept per phase.
+
+## One-time setup when you first push this
+
+The child Application in `apps/gitops-demo.yaml` has a placeholder repo URL.
+Replace it with this repo's real HTTPS URL before (or right after) the first push:
+
+```
+# from the repo root, replace the placeholder in every apps/*.yaml:
+sed -i 's#REPLACE_WITH_MANIFEST_REPO_URL#https://gitea.lgkentang.com/you/k3s-manifests.git#' apps/*.yaml
+git add -A && git commit -m "point apps at real repo url" && git push
+```
+
+## Onboarding a new service later
+
+1. Add `myservice/dev/` manifests (deployment, service, ingress).
+2. Add `apps/myservice.yaml` (copy `gitops-demo.yaml`, change name + path).
+3. Commit + push. ArgoCD's root app picks it up — no cluster access needed.
diff --git a/apps/gitops-demo.yaml b/apps/gitops-demo.yaml
new file mode 100644
index 0000000..e4444b2
--- /dev/null
+++ b/apps/gitops-demo.yaml
@@ -0,0 +1,27 @@
+# A child Application in the app-of-apps tree. ArgoCD's root app finds this file
+# and creates this Application, which in turn syncs gitops-demo/dev into the
+# cluster. To add another service, copy this file and change name + path.
+#
+# NOTE: replace REPLACE_WITH_MANIFEST_REPO_URL with this repo's real HTTPS URL
+# (see README) — child Applications can't be templated by our shell scripts
+# because ArgoCD reads them straight from git.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gitops-demo-dev
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.lgkentang.com/you/k3s-manifests.git
+    targetRevision: HEAD
+    path: gitops-demo/dev
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dev          # per-environment namespace convention
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/gitops-demo/dev/deployment.yaml b/gitops-demo/dev/deployment.yaml
new file mode 100644
index 0000000..4bdb3e8
--- /dev/null
+++ b/gitops-demo/dev/deployment.yaml
@@ -0,0 +1,23 @@
+# Plain Deployment — note there is NO `namespace:` here. ArgoCD places it in the
+# namespace named by the Application's destination (dev). Leaving it out keeps
+# these manifests reusable for prod later (a prod Application would drop the
+# same files into the prd namespace).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitops-demo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitops-demo
+  template:
+    metadata:
+      labels:
+        app: gitops-demo
+    spec:
+      containers:
+        - name: whoami
+          image: traefik/whoami:latest
+          ports:
+            - containerPort: 80
diff --git a/gitops-demo/dev/ingress.yaml b/gitops-demo/dev/ingress.yaml
new file mode 100644
index 0000000..7201105
--- /dev/null
+++ b/gitops-demo/dev/ingress.yaml
@@ -0,0 +1,27 @@
+# Same Ingress shape as Phases 1-2, now delivered via GitOps. When ArgoCD syncs
+# this, the full platform reacts: cert-manager issues the cert, external-dns
+# creates the A record, Traefik routes it. A brand-new host proves the whole
+# chain end-to-end from a single git commit.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitops-demo
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - gitops-demo.dev.lgkentang.com
+      secretName: gitops-demo-tls
+  rules:
+    - host: gitops-demo.dev.lgkentang.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitops-demo
+                port:
+                  number: 80
diff --git a/gitops-demo/dev/service.yaml b/gitops-demo/dev/service.yaml
new file mode 100644
index 0000000..12cfddb
--- /dev/null
+++ b/gitops-demo/dev/service.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitops-demo
+spec:
+  selector:
+    app: gitops-demo
+  ports:
+    - port: 80
+      targetPort: 80