Initial monorepo scaffold

Turborepo + pnpm monorepo for k3s homelab cluster on Intel NUCs.

- Apps: Next.js web frontend, Express API (TypeScript, Dockerfiles, k8s manifests)
- Packages: shared UI, ESLint config, TypeScript config, Drizzle DB schemas
- Infra/Ansible: bare-metal provisioning with roles for common, k3s-server, k3s-agent, hardening
- Infra/Kubernetes: ArgoCD GitOps (app-of-apps + ApplicationSets), platform components
  (cert-manager, Traefik, CloudNativePG, Valkey, Longhorn, Sealed Secrets), namespaces
- Observability: kube-prometheus-stack, Loki, Promtail as ArgoCD Applications
- CI/CD: GitHub Actions for PR builds, preview deploys, production deploys
- DX: Taskfile, utility scripts, copier templates, Ubiquiti network docs

.github/workflows/ci.yaml

@@ -0,0 +1,79 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      apps: ${{ steps.filter.outputs.changes }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            web:
+              - 'apps/web/**'
+              - 'packages/**'
+            api:
+              - 'apps/api/**'
+              - 'packages/**'
+
+  lint-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm turbo lint test
+
+  build:
+    needs: [changes, lint-and-test]
+    runs-on: ubuntu-latest
+    if: needs.changes.outputs.apps != '[]'
+    strategy:
+      matrix:
+        app: ${{ fromJson(needs.changes.outputs.apps) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm turbo build --filter=@homelab/${{ matrix.app }}
+
+      - name: Build Docker image
+        run: |
+          docker build \
+            -t ghcr.io/${{ github.repository_owner }}/homelab-${{ matrix.app }}:${{ github.sha }} \
+            -t ghcr.io/${{ github.repository_owner }}/homelab-${{ matrix.app }}:pr-${{ github.event.number }} \
+            apps/${{ matrix.app }}
+
+      - name: Push to GHCR
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          docker push ghcr.io/${{ github.repository_owner }}/homelab-${{ matrix.app }}:${{ github.sha }}

.github/workflows/deploy-preview.yaml

@@ -0,0 +1,59 @@
+name: Deploy Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Determine changed apps
+        id: changes
+        run: |
+          APPS=$(pnpm turbo build --filter='...[origin/main]' --dry-run=json | jq -r '[.packages[] | select(startswith("@homelab/")) | sub("@homelab/";"") ] | join(",")')
+          echo "apps=$APPS" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push images
+        if: steps.changes.outputs.apps != ''
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          IFS=',' read -ra APPS <<< "${{ steps.changes.outputs.apps }}"
+          for app in "${APPS[@]}"; do
+            docker build \
+              -t ghcr.io/${{ github.repository_owner }}/homelab-${app}:${{ github.sha }} \
+              apps/${app}
+            docker push ghcr.io/${{ github.repository_owner }}/homelab-${app}:${{ github.sha }}
+          done
+
+      - name: Update image tags in preview overlay
+        if: steps.changes.outputs.apps != ''
+        run: |
+          IFS=',' read -ra APPS <<< "${{ steps.changes.outputs.apps }}"
+          for app in "${APPS[@]}"; do
+            cd apps/${app}/k8s/overlays/preview
+            kustomize edit set image ghcr.io/${{ github.repository_owner }}/homelab-${app}=ghcr.io/${{ github.repository_owner }}/homelab-${app}:${{ github.sha }}
+            cd -
+          done
+
+      - name: Comment preview URL
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `## Preview Deploy\nNamespace: \`preview-${context.issue.number}\`\nArgoCD will sync automatically from branch \`${context.payload.pull_request.head.ref}\`.`
+            })

.github/workflows/deploy-production.yaml

@@ -0,0 +1,59 @@
+name: Deploy Production
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Determine changed apps
+        id: changes
+        run: |
+          APPS=$(pnpm turbo build --filter='...[HEAD~1]' --dry-run=json | jq -r '[.packages[] | select(startswith("@homelab/")) | sub("@homelab/";"") ] | join(",")')
+          echo "apps=$APPS" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push images
+        if: steps.changes.outputs.apps != ''
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          IFS=',' read -ra APPS <<< "${{ steps.changes.outputs.apps }}"
+          for app in "${APPS[@]}"; do
+            docker build \
+              -t ghcr.io/${{ github.repository_owner }}/homelab-${app}:${{ github.sha }} \
+              -t ghcr.io/${{ github.repository_owner }}/homelab-${app}:latest \
+              apps/${app}
+            docker push ghcr.io/${{ github.repository_owner }}/homelab-${app}:${{ github.sha }}
+            docker push ghcr.io/${{ github.repository_owner }}/homelab-${app}:latest
+          done
+
+      - name: Update image tags in production overlay
+        if: steps.changes.outputs.apps != ''
+        run: |
+          IFS=',' read -ra APPS <<< "${{ steps.changes.outputs.apps }}"
+          for app in "${APPS[@]}"; do
+            cd apps/${app}/k8s/overlays/production
+            kustomize edit set image ghcr.io/${{ github.repository_owner }}/homelab-${app}=ghcr.io/${{ github.repository_owner }}/homelab-${app}:${{ github.sha }}
+            cd -
+          done
+
+      - name: Commit image tag updates
+        if: steps.changes.outputs.apps != ''
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add apps/*/k8s/overlays/production/
+          git diff --staged --quiet || git commit -m "deploy: update production images to ${{ github.sha }}"
+          git push