# Argo CD integration without buying a domain

This project uses a secure push model instead of exposing Argo CD publicly.

## Architecture

```text
Docker Desktop Kubernetes
  -> kubectl reads Application CRDs locally
  -> PowerShell bridge removes unnecessary fields
  -> HTTPS POST to /api/argocd/ingest
  -> Cloudflare Pages Function verifies DEVOPS_ADMIN_TOKEN
  -> D1 stores only the latest sanitized snapshot
  -> Dashboard reads the snapshot
```

Argo CD remains private on the laptop. No custom domain, tunnel, router port, `ARGOCD_BASE_URL`, or Cloudflare-side `ARGOCD_TOKEN` is needed.

## Cloudflare settings

Keep the existing D1 binding:

```text
Type: D1 database
Name: DB
```

Create or keep this secret:

```text
Name: DEVOPS_ADMIN_TOKEN
Type: Secret
Value: a long random value
```

Generate a strong value in PowerShell if needed:

```powershell
$bytes = New-Object byte[] 48
[Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
$token = [Convert]::ToBase64String($bytes)
$token | Set-Clipboard
```

Use the same value locally when running the bridge.

You may delete these Cloudflare variables in no-domain mode:

```text
ARGOCD_BASE_URL
ARGOCD_TOKEN
```

## Run the bridge on Windows

Open PowerShell in the extracted project directory:

```powershell
$env:DEVOPS_ADMIN_TOKEN = "PASTE_THE_SAME_DEVOPS_ADMIN_TOKEN"

powershell -ExecutionPolicy Bypass `
  -File .\scripts\push-argocd-snapshot.ps1
```

The project URL defaults to `https://devops-website-a9i.pages.dev`. If `DEVOPS_ADMIN_TOKEN` is not set, the script asks for it securely. The default refresh interval is 60 seconds. Keep the window open while the local cluster is running.

Run only one snapshot:

```powershell
powershell -ExecutionPolicy Bypass `
  -File .\scripts\push-argocd-snapshot.ps1 `
  -Once
```

Choose another interval:

```powershell
powershell -ExecutionPolicy Bypass `
  -File .\scripts\push-argocd-snapshot.ps1 `
  -IntervalSeconds 30
```

## Requirements

- Docker Desktop Kubernetes is running.
- `kubectl config current-context` points to the intended cluster.
- Argo CD is installed.
- D1 is bound as `DB`.
- `DEVOPS_ADMIN_TOKEN` is identical locally and in Cloudflare.

## Verify

```powershell
Invoke-RestMethod "https://devops-website-a9i.pages.dev/api/health"
Invoke-RestMethod "https://devops-website-a9i.pages.dev/api/argocd/apps"
```

Expected health fields:

```json
{
  "argocd_mode": "local-push",
  "argocd_snapshot_available": true
}
```

The snapshot remains visible in D1 when the laptop or bridge is temporarily offline. It becomes stale until the bridge runs again, but no public access to Argo CD is introduced.