---
paths: ["manifests/**", "**/*.yaml"]
---

# Manifests — ArgoCD, deliberate sync, secrets

## One app, and auto-sync is OFF

The whole cluster is GitOps via a **single ArgoCD app `felhom`** syncing this repo's `manifests/` to
the `felhom-system` namespace. **Auto-sync is OFF — a deploy is a deliberate manual sync.**

ArgoCD's source of truth is the **manifest in git**:

- Committing a manifest change deploys nothing until the app is synced.
- **Pin explicit image versions, never `:latest`.**
- **Never bare `kubectl set image` / `kubectl apply`** — the next sync reverts it, so the fix looks
  like it worked and then silently disappears.
- Sync method (hard-refresh + sync, local `sudo kubectl`): the **`felhom-build-deploy`** skill.

## Secrets

- **Out-of-band `secretKeyRef` only — never inline `stringData`** (`REUSE.md` §3).
- `manifest_bearer_gate.py` fails on any bearer-shaped literal anywhere under `manifests/`. It runs
  from `python3 scripts/repo_gates.py`.

## The installer is no longer served from a manifest

Until 2026-11-07 `manifests/webpage.yaml` ran DooPlex's copy of the website and pinned the installer tag in two
`--ref` lines. That copy is retired (R-1228); `webpage.yaml` now holds only FileBrowser. The installer tag lives in
`INSTALLER-TAG` at the repo root, and `hostinstall_gates.py` gate 6 fails if any manifest pins one again. The full
publish/rollback procedure is the R-110 fence in the repo core `CLAUDE.md`.