---
# ArgoCD AppProject — neuron-prod
# Restricts which repos can deploy to which namespaces.
# Prevents misconfigured apps from deploying cluster-admin RBAC or
# accidentally targeting personal/hobby namespaces.
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: neuron-prod
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  description: "Neuron Technologies production services"

  # Only allow deployments sourced from the infrastructure repo.
  sourceRepos:
    - "http://gitea.git.svc.cluster.local:3000/will/infrastructure.git"
    - "https://code.forgejo.org"
    - "registry.neuralplatform.ai"

  # Only allow deploying to neuron-prod and platform namespaces.
  destinations:
    - server: https://kubernetes.default.svc
      namespace: neuron-prod
    - server: https://kubernetes.default.svc
      namespace: platform

  # Cluster-scoped resources this project may NOT create.
  clusterResourceBlacklist:
    - group: rbac.authorization.k8s.io
      kind: ClusterRole
    - group: rbac.authorization.k8s.io
      kind: ClusterRoleBinding
    - group: ""
      kind: Namespace

  # Namespace-scoped resources this project may create.
  namespaceResourceWhitelist:
    - group: "apps"
      kind: Deployment
    - group: "apps"
      kind: ReplicaSet
    - group: "batch"
      kind: CronJob
    - group: "batch"
      kind: Job
    - group: ""
      kind: Service
    - group: ""
      kind: ConfigMap
    - group: ""
      kind: Secret
    - group: ""
      kind: PersistentVolumeClaim
    - group: ""
      kind: ServiceAccount
    - group: "networking.k8s.io"
      kind: Ingress
    - group: "networking.k8s.io"
      kind: NetworkPolicy
    - group: "policy"
      kind: PodDisruptionBudget
    - group: "autoscaling"
      kind: HorizontalPodAutoscaler
    - group: "traefik.io"
      kind: IngressRoute
    - group: "external-secrets.io"
      kind: ExternalSecret
    - group: "monitoring.coreos.com"
      kind: ServiceMonitor
    - group: "monitoring.coreos.com"
      kind: PrometheusRule

  # Sync windows: only allow automated syncs during low-traffic hours.
  # Manual syncs allowed any time.
  syncWindows:
    - kind: allow
      schedule: "0 2-6 * * *"   # 2am-6am UTC (off-peak)
      duration: 4h
      applications:
        - "*"
      manualSync: true
    - kind: allow
      schedule: "* * * * *"
      duration: "1m"
      manualSync: true           # Always allow manual deploys
      applications:
        - "*"