From db6afaf180db126a053b6df8d6a8d12b43fb2478 Mon Sep 17 00:00:00 2001
From: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>
Date: Tue, 28 Apr 2026 22:44:57 +0200
Subject: [PATCH] vault

Co-authored-by: Copilot <copilot@github.com>
---
 infra/base/kustomization.yaml               |  1 +
 infra/base/vault/kustomization.yaml         |  4 ++
 infra/base/vault/vault.yaml                 | 43 +++++++++++++++++++++
 infra/values/base/homepage-values.yaml      |  4 +-
 infra/values/base/keycloak-values.yaml      |  2 +-
 infra/values/base/vault-values.yaml         | 36 +++++++++++++++++
 infra/values/upc-dev/databunker-values.yaml |  2 +-
 infra/values/upc-dev/vault-values.yaml      |  9 +++++
 8 files changed, 97 insertions(+), 4 deletions(-)
 create mode 100644 infra/base/vault/kustomization.yaml
 create mode 100644 infra/base/vault/vault.yaml
 create mode 100644 infra/values/base/vault-values.yaml
 create mode 100644 infra/values/upc-dev/vault-values.yaml

diff --git a/infra/base/kustomization.yaml b/infra/base/kustomization.yaml
index 7c18dc8..6e802ef 100644
--- a/infra/base/kustomization.yaml
+++ b/infra/base/kustomization.yaml
@@ -22,3 +22,4 @@ resources:
 - karpor
 - databunker
 - homepage
+- vault
diff --git a/infra/base/vault/kustomization.yaml b/infra/base/vault/kustomization.yaml
new file mode 100644
index 0000000..9d00240
--- /dev/null
+++ b/infra/base/vault/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- vault.yaml
diff --git a/infra/base/vault/vault.yaml b/infra/base/vault/vault.yaml
new file mode 100644
index 0000000..1e59103
--- /dev/null
+++ b/infra/base/vault/vault.yaml
@@ -0,0 +1,43 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vault
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/part-of: security
+    app.kubernetes.io/managed-by: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  sources:
+  - repoURL: https://helm.releases.hashicorp.com
+    chart: vault
+    targetRevision: "0.32.0"
+    helm:
+      releaseName: vault
+      valueFiles:
+      - $values/infra/values/base/vault-values.yaml
+      - $values/infra/values/upc-dev/vault-values.yaml
+
+  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    targetRevision: HEAD
+    ref: values
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: vault
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+    - CreateNamespace=true
+    - Validate=true
+    - ServerSideApply=true
diff --git a/infra/values/base/homepage-values.yaml b/infra/values/base/homepage-values.yaml
index 22066ed..6df2480 100644
--- a/infra/values/base/homepage-values.yaml
+++ b/infra/values/base/homepage-values.yaml
@@ -23,9 +23,9 @@ config:
       Apps:
         style: row
         columns: 3
-      Identity:
+      Security:
         style: row
-        columns: 2
+        columns: 3
       DevOps:
         style: row
         columns: 2
diff --git a/infra/values/base/keycloak-values.yaml b/infra/values/base/keycloak-values.yaml
index c88510a..fbef335 100644
--- a/infra/values/base/keycloak-values.yaml
+++ b/infra/values/base/keycloak-values.yaml
@@ -21,7 +21,7 @@ ingress:
     gethomepage.dev/enabled: "true"
     gethomepage.dev/name: "Keycloak"
     gethomepage.dev/description: "Identity & access management"
-    gethomepage.dev/group: "Identity"
+    gethomepage.dev/group: "Security"
     gethomepage.dev/icon: "keycloak"
     gethomepage.dev/href: "https://id.forteapps.net/admin/forte-test/console/"
 
diff --git a/infra/values/base/vault-values.yaml b/infra/values/base/vault-values.yaml
new file mode 100644
index 0000000..0141ef2
--- /dev/null
+++ b/infra/values/base/vault-values.yaml
@@ -0,0 +1,36 @@
+# HashiCorp Vault Helm Chart Values
+# Chart: hashicorp/vault v0.32.0
+
+server:
+  standalone:
+    enabled: true
+
+  dataStorage:
+    enabled: true
+    size: 5Gi
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 250m
+      memory: 256Mi
+
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    pathType: Prefix
+    activeService: true
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+      gethomepage.dev/enabled: "true"
+      gethomepage.dev/name: "Vault"
+      gethomepage.dev/description: "Secrets management"
+      gethomepage.dev/group: "Security"
+      gethomepage.dev/icon: "vault"
+      gethomepage.dev/href: "https://vault.forteapps.net"
+
+ui:
+  enabled: true
+  serviceType: ClusterIP
diff --git a/infra/values/upc-dev/databunker-values.yaml b/infra/values/upc-dev/databunker-values.yaml
index fcbda4e..38734ef 100644
--- a/infra/values/upc-dev/databunker-values.yaml
+++ b/infra/values/upc-dev/databunker-values.yaml
@@ -5,6 +5,6 @@ ingress:
     gethomepage.dev/enabled: "true"
     gethomepage.dev/name: "Databunker"
     gethomepage.dev/description: "Secure Database for PII and PCI Records"
-    gethomepage.dev/group: "Identity"
+    gethomepage.dev/group: "Security"
     gethomepage.dev/icon: "adminer"
     gethomepage.dev/href: "https://databunker.forteapps.net"
diff --git a/infra/values/upc-dev/vault-values.yaml b/infra/values/upc-dev/vault-values.yaml
new file mode 100644
index 0000000..f6755f9
--- /dev/null
+++ b/infra/values/upc-dev/vault-values.yaml
@@ -0,0 +1,9 @@
+server:
+  ingress:
+    hosts:
+    - host: vault.forteapps.net
+      paths: []
+    tls:
+    - secretName: vault-tls
+      hosts:
+      - vault.forteapps.net