Onboard an app

Onboarding means: build an image, push it to GHCR, add workloads/<app>/{base,overlays/staging,overlays/prod} and two rows in apps/workloads.yaml. Argo CD reconciles. Penvoice and Talon are worked examples, not special cases.

A new server is Provision from scratch. This page is a new app on an already provisioned cluster.

The pipeline

flowchart LR
  Code([merge to app main]) --> CI[CI builds sha]
  CI --> Stg[loom overlays/staging newTag]
  Stg --> SyncS[Argo syncs staging]
  SyncS --> Promo[Promote Action]
  Promo --> Prod[overlays/prod same digest]

The recipe

1. Build & CI — image to GHCR.
2. GitOps & deploy — base + overlays + ApplicationSet entries.
3. Database & migrations — CNPG if the app needs Postgres.
4. Canary — timed steps only until a metrics stack exists.
5. Secrets — Infisical GUI for values; Git only has the sync CRs.

Folder layout

loom/
├── apps/workloads.yaml          # add two list elements: app × staging|prod
└── workloads/<app>/
    ├── base/                    # Rollout, Service, Ingress, Redis, Infisical CRs, optional CNPG
    └── overlays/{staging,prod}/ # namespace, host, env slug, image tag

Copy workloads/penvoice/ (or whatever example is current) and rename. Do not add a per-app file under apps/ except through the ApplicationSet.