# selfheal-lab-gitops

GitOps and configuration repository for the self-healing verification lab
(VM + container mixed environment). Infrastructure lives in
`seon-labs/selfheal-lab-terraform`; this repository holds everything that runs
on top of it.

This repository is **public on purpose**: every EC2 node and GCE VM clones it
anonymously at first boot (cloud-init / startup script), and MIG instances are
recreated by autohealing without an operator. Never commit secrets here; values
live in GCP Secret Manager and are fetched at runtime.

| Path | Owner | Filled in |
|---|---|---|
| `bootstrap/kubeadm/` | operator, run once | WP-07: containerd/kubeadm init+join, flannel, Argo CD install, root-app |
| `argocd/root-app.yaml` | Argo CD app-of-apps root | WP-07 |
| `apps/` | child Argo CD Applications | WP-14 |
| `workloads/{demo-app,ingress-nginx,chaos-mesh,alloy}/` | Argo CD | WP-14, WP-15 |
| `vm/<role>/apply.sh` | GCE startup script and `make vm-sync` | WP-08..12 |

`vm/<role>` matches the `role` metadata each VM gets from Terraform:
`observability`, `harness`, `ai-env`, `postgres-primary`, `postgres-replica`,
`legacy-api`. The startup script runs `vm/<role>/apply.sh` when it exists and is
executable; `apply.sh` must be idempotent because `make vm-sync` re-runs it.