feat(htpc): initial repository structure and gitops workflow

.gitea/workflows/build-and-deploy.yaml

@@ -0,0 +1,76 @@
+name: Sync HTPC Manifests to GitOps
+
+on:
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - 'k8s/**'
+      - '.gitea/workflows/**'
+
+permissions:
+  contents: read
+
+env:
+  GITOPS_REPO: git.bnhmeijer.nl/bart/k8s-infra-vmserver.git
+  GITOPS_PATH: workloads/htpc
+  ARGOCD_SERVER: ${{ vars.ARGOCD_SERVER || 'argocd.bnhmeijer.nl' }}
+
+jobs:
+  sync-to-gitops:
+    name: Sync Manifests to GitOps Repo
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout htpc repository
+        uses: actions/checkout@v4
+
+      - name: Sync manifests to k8s-infra-vmserver
+        env:
+          TOKEN: ${{ secrets.GITOPS_PAT || secrets.CI_TOKEN }}
+          GITEA_SHA: ${{ gitea.sha }}
+        run: |
+          git config --global user.name "Gitea Actions Bot"
+          git config --global user.email "actions@git.bnhmeijer.nl"
+
+          echo "Cloning GitOps repository..."
+          git clone https://${TOKEN}@${GITOPS_REPO} gitops-repo
+
+          echo "Syncing k8s manifests into ${GITOPS_PATH}..."
+          mkdir -p "gitops-repo/${GITOPS_PATH}"
+          rm -rf "gitops-repo/${GITOPS_PATH}"/*
+          cp -r k8s/* "gitops-repo/${GITOPS_PATH}/"
+
+          cd gitops-repo
+          if [ -n "$(git status --porcelain)" ]; then
+            git add .
+            git commit -m "ci(htpc): sync manifests (${GITEA_SHA::7})"
+            git push origin main
+            echo "Successfully pushed updated manifests to k8s-infra-vmserver!"
+          else
+            echo "No manifest changes detected in GitOps repository."
+          fi
+
+      - name: Trigger ArgoCD Sync for htpc
+        env:
+          ARGOCD_SERVER: ${{ env.ARGOCD_SERVER }}
+          ARGOCD_TOKEN: ${{ secrets.ARGOCD_TOKEN }}
+        run: |
+          if [ -n "$ARGOCD_TOKEN" ]; then
+            SERVER_URL="${ARGOCD_SERVER}"
+            if [[ ! "$SERVER_URL" =~ ^https?:// ]]; then
+              SERVER_URL="https://${SERVER_URL}"
+            fi
+
+            echo "Triggering ArgoCD sync for application htpc on $SERVER_URL..."
+            RESPONSE=$(curl -s -S -k -w "\nHTTP_STATUS:%{http_code}" -X POST \
+              -H "Authorization: Bearer $ARGOCD_TOKEN" \
+              -H "Content-Type: application/json" \
+              "${SERVER_URL}/api/v1/applications/htpc/sync" || true)
+
+            HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS:" | cut -d':' -f2)
+            BODY=$(echo "$RESPONSE" | grep -v "HTTP_STATUS:")
+            echo "ArgoCD API Response (HTTP $HTTP_STATUS): $BODY"
+          else
+            echo "ARGOCD_TOKEN secret is not set, skipping ArgoCD sync trigger (ArgoCD auto-sync will pick up changes)."
+          fi

.gitignore

@@ -0,0 +1,12 @@
+# OS & Editor files
+.DS_Store
+Thumbs.db
+*~
+*.swp
+
+# Secrets & Local overrides
+*.env
+*.local
+secrets/
+*.key
+*.pem

README.md

@@ -0,0 +1,49 @@
+# HTPC & Media Services Platform
+
+Beheert de configuratie, deployment en automatisering van de HTPC (Home Theater PC) en media-stack voor `bnhmeijer.nl` op `vmserver` (`10.2.0.4`).
+
+---
+
+## 🧭 Inhoudsopgave
+
+- [Overzicht](#-overzicht)
+- [Applicaties & Services](#-applicaties--services)
+- [Architectuur & Ingress](#-architectuur--ingress)
+- [Opslag & Mounts](#-opslag--mounts)
+- [GitOps & Deployment](#-gitops--deployment)
+
+---
+
+## 📌 Overzicht
+
+Deze repository bevat de Kubernetes manifests, configuraties en eventuele hulpscripts voor de HTPC mediadiensten. De workloads worden beheerd via GitOps (Gitea Actions en ArgoCD) binnen het homelab cluster.
+
+---
+
+## 🎬 Applicaties & Services
+
+De HTPC omgeving omvat onder andere de volgende diensten:
+
+| Service | Poort | Beschrijving |
+| :--- | :--- | :--- |
+| **Jellyfin** | `8096` | Media streaming en playback server voor films, series en muziek |
+| **Sonarr** | `8989` | Automatisch beheer en downloaden van tv-series |
+| **Radarr** | `7878` | Automatisch beheer en downloaden van speelfilms |
+| **Lidarr** | `8686` | Automatisch beheer en downloaden van muziek |
+| **Bazarr** | `6767` | Ondertitelbeheer en synchronisatie |
+| **Jackett / Prowlarr** | `9117` / `9696` | Torrent- en usenet indexer proxy |
+| **SABnzbd / Torrent** | `8080` / `8085` | Downloadclients voor media-acquisitie |
+
+---
+
+## 🏛️ Architectuur & Ingress
+
+- **SSL & Reverse Proxy**: Inkomend verkeer verloopt via de centrale Apache reverse proxy op `thuus.bnhmeijer.nl`.
+- **Authenticatie**: Beveiligd via Keycloak OIDC of ingebouwde service-authenticatie.
+- **Interne routering**: Envoy Gateway HTTPRoutes routeren verkeer direct naar de betreffende Kubernetes pods in de `htpc` namespace.
+
+---
+
+## 🔄 GitOps & Deployment
+
+Wijzigingen in de `k8s/` manifests worden automatisch gesynchroniseerd via Gitea Actions naar de centrale GitOps repository [`k8s-infra-vmserver`](https://git.bnhmeijer.nl/bart/k8s-infra-vmserver.git) onder `workloads/htpc/`, waarna ArgoCD deze reconcileert.

k8s/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: htpc
+
+resources:
+  - namespace.yaml

k8s/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: htpc
+  labels:
+    app.kubernetes.io/name: htpc