Restructure and variablize config

README.md

@@ -23,7 +23,7 @@ GitOps cluster management for dumpnet — a single-node Talos/Kubernetes cluster
 
 Sensitive files (`talosconfig`, `controlplane.yaml`, `worker.yaml`) are **gitignored** and never stored in the repo in any form. They are managed as follows:
 
-- **Cluster credentials** (kubeconfig, talosconfig, ArgoCD password) → stored in AWS Secrets Manager at `dumpnet/cluster`
+- **Cluster credentials** (kubeconfig, talosconfig, ArgoCD password) → stored in AWS Secrets Manager at `dumpnet`
 - **Talos machine configs** → encrypted with SOPS + age, stored outside the repo
 - **Age private key** → lives at `~/.age/key.txt` — **back this up securely**
 
@@ -57,6 +57,13 @@ cp terraform/terraform.tfvars.example terraform/terraform.tfvars
 make apply
 ```
 
+> **Note:** `make apply` runs two Terraform passes internally. The first pass
+> (`-target=talos_cluster_kubeconfig.this`) brings up the EC2 instance, bootstraps
+> the cluster, and retrieves the kubeconfig. The second pass then uses that live
+> kubeconfig to provision Kubernetes resources (namespaces, ArgoCD Helm release).
+> This two-phase approach is necessary because the Helm and Kubernetes Terraform
+> providers need a reachable cluster to initialize.
+
 This will:
 - Allocate an EIP
 - Create a dedicated subnet and security group
@@ -90,11 +97,23 @@ make argocd-password
 
 Then log in at https://argocd.dumpnet.chat — ArgoCD will finish deploying ingress-nginx and metrics-server automatically.
 
+## Rebuilding from Scratch
+
+To fully tear down and recreate the cluster:
+
+```bash
+make clean    # force-delete secret, empty S3, clear stale kube/talos contexts
+make destroy  # tear down all terraform resources
+make apply    # recreate everything
+make post-apply  # wait for cluster ready, bootstrap ArgoCD
+make bootstrap   # apply App of Apps
+```
+
 ## Day-to-Day
 
 - **Add a new app**: add a manifest to `manifests/` and values to `charts/` — ArgoCD picks it up on next sync
 - **Add a DNS record**: add the subdomain to `dns_records` in `terraform/terraform.tfvars` and run `make apply`
-- **Cluster access**: `make kubeconfig` or `make talosconfig` (pulls from Secrets Manager)
+- **Cluster access**: `make kubeconfig` or `make talosconfig` (pulls from Secrets Manager, safe to re-run — automatically clears any stale context from a previous cluster before merging)
 - **Emergency talosctl access**: `make decrypt` to get configs in `/tmp`
 
 ## Makefile Reference
@@ -104,9 +123,10 @@ Then log in at https://argocd.dumpnet.chat — ArgoCD will finish deploying ingr
 | `make apply` | Create/update cluster infrastructure |
 | `make plan` | Preview infrastructure changes |
 | `make destroy` | Tear down everything |
+| `make clean` | Pre-destroy cleanup (force-delete secret, empty S3 buckets, clear stale kube/talos contexts) |
 | `make post-apply` | One-time bootstrap after fresh cluster creation |
 | `make bootstrap` | Apply App of Apps only |
-| `make kubeconfig` | Pull kubeconfig from Secrets Manager |
+| `make kubeconfig` | Pull kubeconfig from Secrets Manager (clears stale context first) |
 | `make talosconfig` | Pull talosconfig from Secrets Manager |
 | `make argocd-password` | Print ArgoCD admin password |
 | `make decrypt` | Decrypt Talos configs to /tmp |
@@ -141,6 +161,22 @@ dumpnet-argo/
     └── outputs.tf
 ```
 
+## Forking / Multiple Environments
+
+Global per-cluster config lives in **`values.yaml`** at the repo root:
+
+```yaml
+clusterName: dumpnet
+domain: dumpnet.chat
+repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+certEmail: dumpnetcerts@keane.sh
+awsRegion: us-east-1
+```
+
+This file is passed as the first `valueFiles` entry to every Helm chart, so `domain`, `certEmail`, `clusterName`, and `awsRegion` are available as `{{ .Values.* }}` in all chart values. Terraform variables in `terraform/variables.tf` mirror these same settings for the infrastructure side.
+
+**The one thing that can't be templated** is `repoURL` in the ArgoCD `Application` manifests themselves (under `apps/` and `manifests/`). These are plain YAML consumed by ArgoCD before any Helm rendering happens — there's no way to interpolate them without a [Config Management Plugin](https://argo-cd.readthedocs.io/en/stable/operator-manual/config-management-plugins/). When forking this repo, do a global find/replace on `forge.keane.sh/ian/dumpnet-argo` with your own repo URL.
+
 ## Notes
 
 - The control plane taint is disabled via `allowSchedulingOnControlPlanes: true` in the Talos machine config — no manual taint removal needed