# Roberto DevOps Platform Architecture

## Navigation structure

```text
⚙ DevOps Platform
├── Overview
├── Documentation
├── GitHub
├── GitHub Actions — https://github.com/actions/runner
├── Helm — https://github.com/helm/helm
├── Argo CD — https://github.com/argoproj/argo-cd
├── Build
├── Test
├── Deploy
├── Release
├── Rollback
└── Security Scan
```

## Delivery architecture

```text
Developer commit
  → GitHub pull request
  → GitHub Actions Runner
  → Build + lint + tests + security scan
  → OCI image + Helm chart + SBOM/provenance
  → GitOps desired-state update
  → Argo CD reconciliation
  → Kubernetes deployment
  → production health verification
  → release or controlled rollback
```

## Domain-free Argo CD data path

The Argo CD control plane stays local inside Docker Desktop Kubernetes. The included PowerShell bridge reads sanitized application status through `kubectl` and sends the snapshot to the authenticated Pages Function endpoint. Cloudflare D1 stores only the latest normalized application state and the dashboard reads it through `/api/argocd/apps`.

```text
Local Kubernetes → kubectl → PowerShell bridge → Pages Function → D1 → dashboard
```

No purchased domain, public Argo CD ingress, Cloudflare Tunnel, or `ARGOCD_BASE_URL` is required for this mode.

## Runtime boundaries

- **Browser:** route navigation, data visualization and optional admin workflow dispatch.
- **Cloudflare Pages Function:** GitHub proxy, D1 persistence, monitoring probes, webhook verification and protected dispatch.
- **D1:** delivery events, dispatch audit and latest Argo CD snapshot.
- **GitHub:** source, workflow runs, releases and GitOps state.
- **Local cluster:** Argo CD, Helm-managed workloads and Kubernetes health.

## Security model

- Fine-grained GitHub tokens with repository-specific permissions.
- `DEVOPS_ADMIN_TOKEN` protects workflow dispatch and Argo CD snapshot ingestion.
- `GITHUB_WEBHOOK_SECRET` verifies webhook signatures.
- Argo CD API token remains local in domain-free mode and is not needed by Cloudflare.
- Production changes are declarative and version controlled.