Monobase Infrastructure (mono-infra)

Multi-tenant Kubernetes infrastructure for healthcare SaaS (MyCure, HapiHub). GitOps-driven with ArgoCD, Helm charts, and Terraform/OpenTofu. The live DOKS cluster is OpenTofu-managed from values/cluster.

Repository Structure

charts/               # Everything deployable is a chart
  argocd-bootstrap/       # Infrastructure root + auto-discover ApplicationSet
  argocd-applications/    # Per-deployment Application factory + dedicated templates
  argocd-infrastructure/  # Cluster-wide infrastructure apps
  app/                    # Generic frontend/service chart (consolidates clones)
  <bespoke charts>        # hapihub, cadence, nginx-gateway, security-baseline, ...
terraform/            # IaC modules for 6 providers
  modules/                # aws-eks, azure-aks, gcp-gke, do-doks, on-prem-k3s, local-k3d
values/               # ALL real configuration
  cluster/                # OpenTofu root for the live DOKS cluster (imported state)
  deployments/            # <product>-<env>.yaml overlays + _base/<product>.yaml
  infrastructure/         # Cluster-wide infra config (main.yaml) + secrets registry
scripts/              # Operational scripts (bootstrap, provision, secrets, admin)
docs/                 # Architecture, operations, security documentation

Tooling

Tool versions and tasks are managed with mise:

mise install          # install pinned tool versions
mise tasks            # list all tasks
mise run lint         # yamllint + helm lint + tflint
mise run validate     # template-render all charts against real values

Key tasks: lint, validate, check, fmt, bootstrap, provision, secrets, admin, cluster-plan, cluster-apply.

How Deployment Works

Everything is GitOps — push to main and ArgoCD syncs:

1. Deployments: edit values/deployments/<client>-<env>.yaml (overlays on values/deployments/_base/<product>.yaml), commit, push. The auto-discover ApplicationSet picks it up and syncs the namespace {client}-{environment}.
2. Cluster-wide infrastructure: edit values/infrastructure/main.yaml (gateway listeners, cert issuers, snippets policies, ...).
3. Cluster itself (node pools, k8s version): values/cluster + mise run cluster-plan / mise run cluster-apply (OpenTofu).
4. Bootstrap (new/empty cluster): select the target kubectl context, then mise run bootstrap -- --cluster-name <cluster> (e.g. mycure-doks-main) — installs ArgoCD and the root apps; everything else flows from Git. The --cluster-name loads values/clusters/<cluster>/argocd/bootstrap.yaml; a bare mise run bootstrap defaults --cluster-name to mycure-doks-main (seeds DOKS prod), so always pass --cluster-name for any other cluster. Bootstrap validates the resolved values (real, non-generic argocd.clusterName
   • existing cluster paths) and aborts before touching the cluster if incomplete.

Direct kubectl changes are reverted by ArgoCD self-heal.

Stack

Concern	Technology
Ingress	Gateway API via NGINX Gateway Fabric — public nginx-shared-gateway (prod-only) + tailnet-only nginx-internal-gateway (cluster default) in nginx-gateway-system
GitOps	ArgoCD App-of-Apps + ApplicationSet auto-discovery
Secrets	External Secrets Operator ← GCP Secret Manager (never commit secrets)
TLS	cert-manager (HTTP-01 via gateway, DNS-01 via Cloudflare)
DNS	external-dns
Backups	Velero (+ on-prem mirror)
Private access	Tailscale operator
Data stores	PostgreSQL, Valkey, MinIO (Bitnami legacy images)
Box sync	cadence (hub + relay), QUIC over the shared gateway

Domains: *.mycureapp.com, *.localfirsthealth.com, *.stg.localfirsthealth.com, *.mycure.md.

Documentation

Index: docs/README.md

• System Architecture
• GitOps with ArgoCD
• Gateway API — NGINX Gateway Fabric, HTTPRoutes
• Multi-Domain Gateway
• Cluster Provisioning
• Client Onboarding
• Backup & DR · DR Runbooks
• Scaling Guide · Troubleshooting
• Security Hardening · Compliance (HIPAA, SOC2, GDPR)

Security & Compliance

• NetworkPolicies — default-deny, allow-specific (see charts/security-baseline)
• Pod Security Standards — restricted profile enforced per namespace
• TLS everywhere via cert-manager; secrets only via External Secrets + GCP SM
• Internal-by-default ingress — routes land on the tailnet gateway unless a deployment explicitly opts into the public gateway

Conventions

• Namespaces: {client}-{environment} (e.g. mycure-production)
• Deployment files: values/deployments/{client}-{environment}.yaml
• Node pools (DOKS): prod-db, prod-apps, infra, nonprod — tainted node-pool=<name>:NoSchedule except nonprod (see Scaling Guide)
• Conventional commits: feat:, fix:, chore:, docs:, refactor:
• See CONTRIBUTING.md