backstage

docs/REFERENCE.md

@@ -965,6 +965,52 @@ ignore:
 - Check Gitea Actions tab for workflow run status and logs
 - Monitor Anthropic usage dashboard for token consumption
 
+### Backstage (Developer Portal)
+
+**Chart**: `backstage/backstage`
+**Version**: `2.6.3`
+**Namespace**: `backstage`
+**Helm Repo**: `https://backstage.github.io/charts`
+
+**Purpose**: Internal developer portal where teams register and broadcast themselves, their applications, APIs, and systems. Provides a unified catalog, templates, and documentation hub.
+
+**Configuration** (`infra/values/base/backstage-values.yaml`):
+- PostgreSQL subchart enabled for persistence (standalone, 2Gi)
+- Traefik ingress with `websecure` entrypoint
+- App title: "Forte Developer Portal"
+- Catalog rules: Component, System, API, Resource, Location, Template, Group, User, Domain
+
+**Catalog Registration**:
+Teams register services by adding a `catalog-info.yaml` to their repo root:
+```yaml
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: my-service
+  description: My service description
+  annotations:
+    backstage.io/source-location: url:https://git.forteapps.net/Forte/my-service
+spec:
+  type: service
+  lifecycle: production
+  owner: team-name
+```
+
+Then add the location to `backstage-values.yaml` under `appConfig.catalog.locations`.
+
+**Per-cluster Configuration**:
+To set the ingress hostname, create a per-cluster overlay values file (e.g., `infra/values/upc-dev/backstage-values.yaml`) with:
+```yaml
+backstage:
+  appConfig:
+    app:
+      baseUrl: https://backstage.example.com
+    backend:
+      baseUrl: https://backstage.example.com
+ingress:
+  host: backstage.example.com
+```
+
 ### Keycloak Client Registrar
 
 **Type**: CronJob (deployed via Keycloak Helm chart `extraDeploy`)

infra/base/backstage.yaml

@@ -0,0 +1,42 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: backstage
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  labels:
+    app.kubernetes.io/name: backstage
+    app.kubernetes.io/part-of: developer-portal
+    app.kubernetes.io/managed-by: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  sources:
+  - repoURL: https://backstage.github.io/charts
+    chart: backstage
+    targetRevision: "2.6.3"
+    helm:
+      releaseName: backstage
+      valueFiles:
+      - $values/infra/values/base/backstage-values.yaml
+
+  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    targetRevision: HEAD
+    ref: values
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: backstage
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+    - CreateNamespace=true
+    - Validate=true
+    - ServerSideApply=true

infra/base/kustomization.yaml

@@ -22,3 +22,4 @@ resources:
 - tempo.yaml
 - grafana-dashboards.yaml
 - network-policies-application.yaml
+- backstage.yaml

infra/values/base/backstage-values.yaml

@@ -0,0 +1,91 @@
+# Backstage - Internal Developer Portal
+# Helm chart: https://github.com/backstage/charts
+
+backstage:
+  image:
+    registry: ghcr.io
+    repository: backstage/backstage
+    tag: latest
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+  extraEnvVars:
+  - name: POSTGRES_HOST
+    value: "{{ .Release.Name }}-postgresql"
+  - name: POSTGRES_PORT
+    value: "5432"
+  - name: POSTGRES_USER
+    value: backstage
+  - name: POSTGRES_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: "{{ .Release.Name }}-postgresql"
+        key: password
+
+  appConfig:
+    app:
+      title: "Forte Developer Portal"
+      baseUrl: http://localhost:3000
+
+    backend:
+      baseUrl: http://localhost:7007
+      listen:
+        port: 7007
+      database:
+        client: pg
+        connection:
+          host: ${POSTGRES_HOST}
+          port: ${POSTGRES_PORT}
+          user: ${POSTGRES_USER}
+          password: ${POSTGRES_PASSWORD}
+
+    catalog:
+      rules:
+      - allow:
+        - Component
+        - System
+        - API
+        - Resource
+        - Location
+        - Template
+        - Group
+        - User
+        - Domain
+      locations:
+      # Register components from Gitea repositories
+      # Example: uncomment and adjust to scan your Gitea org
+      # - type: url
+      #   target: https://git.forteapps.net/Forte/*/blob/main/catalog-info.yaml
+      #   rules:
+      #   - allow: [Component, System, API]
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+
+postgresql:
+  enabled: true
+  auth:
+    username: backstage
+    password: ""
+    existingSecret: ""
+  architecture: standalone
+  primary:
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+      limits:
+        cpu: 250m
+        memory: 256Mi
+    persistence:
+      enabled: true
+      size: 2Gi