Move to a three-node cluster with a Talos VIP; add Longhorn

Every node is now both control plane and worker, giving real tolerance
for losing any single machine (etcd quorum needs 3, not 1). A Talos VIP
gives the cluster one stable address regardless of which node answers.

Also pre-installs Longhorn for replicated storage, backed by a Talos
UserVolume on each node's second disk (>=900GB, non-system) rather than
the default path — mirroring the pattern from the homescale repo.

Docs renumbered to make room for 06-longhorn.md; checklist, glossary,
network map, and CLAUDE.md's guided-bootstrap instructions updated to
match, including asking the user for node IPs, VIP, and disk info before
generating any Talos config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/demo.yaml

@@ -16,7 +16,7 @@
 # (e.g. a database or ingress controller from a public chart repo). Argo CD
 # detects a Helm chart automatically when it finds a Chart.yaml at the
 # source path, resolves its dependencies, and syncs the rendered output just
-# like any other app. See docs/07-adding-new-apps.md for a worked example —
+# like any other app. See docs/08-adding-new-apps.md for a worked example —
 # the demo app deliberately stays plain manifests so the GitOps loop is easy
 # to read end to end with no templating in the way.
 apiVersion: argoproj.io/v1alpha1

apps/demo/configmap.yaml

@@ -4,7 +4,7 @@
 # baking the page into a custom container image.
 #
 # Why this matters for the GitOps story: this is the file you'll edit in
-# docs/06-your-first-change.md. Change the text here, commit, push, and
+# docs/07-your-first-change.md. Change the text here, commit, push, and
 # watch Argo CD notice the difference in Git and push it into the cluster
 # for you — no `kubectl` command involved. That's the whole loop, proven
 # with one line of HTML.

apps/demo/deployment.yaml

@@ -2,7 +2,7 @@
 # serving this ConfigMap's index.html") and hands it to Kubernetes, whose
 # job is to continuously make reality match that description. If the Pod
 # crashes, Kubernetes restarts it. If the node dies, Kubernetes (given more
-# than one node — see docs/08-growing-up.md) reschedules it elsewhere.
+# than one node — see docs/09-growing-up.md) reschedules it elsewhere.
 # You never tell Kubernetes "start a container" directly; you describe the
 # end state and it does the work. This is what "declarative" means.
 apiVersion: apps/v1

apps/longhorn.yaml

@@ -0,0 +1,36 @@
+# Longhorn — this repo's pre-installed storage layer. Same pattern as
+# apps/metallb.yaml: an Application pointing at a Helm chart
+# (apps/longhorn/) that pulls in the official upstream chart. Once this
+# syncs, any app in this cluster can request persistent storage (a
+# PersistentVolumeClaim) and actually get real, replicated storage backed
+# by the dedicated disk each node prepared in
+# talos/patch-longhorn.yaml — see docs/06-longhorn.md.
+#
+# Longhorn needs privileged Pods (it manages block devices directly) and
+# the `open-iscsi`/`util-linux-tools` Talos system extensions baked into
+# your node image — both covered in docs/01-prerequisites.md and
+# docs/02-talos-bootstrap.md. Skipping either means Longhorn's Pods will
+# sit unhealthy no matter how correctly this Application syncs.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: longhorn
+  namespace: argocd
+spec:
+  project: default
+
+  source:
+    repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/longhorn
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: longhorn-system
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/longhorn/Chart.yaml

@@ -0,0 +1,18 @@
+# An umbrella chart, same pattern as apps/metallb/Chart.yaml: it declares a
+# dependency on the upstream Longhorn chart and carries no templates of its
+# own — everything Longhorn needs (its CRDs, controllers, UI, default
+# StorageClass) comes from the dependency. See
+# docs/08-adding-new-apps.md for more on this pattern.
+apiVersion: v2
+name: longhorn-app
+description: Installs Longhorn, this repo's pre-installed distributed block storage
+version: 0.1.0
+dependencies:
+  - name: longhorn
+    # A version range rather than an exact pin — see the same note in
+    # apps/metallb/Chart.yaml. Check
+    # https://artifacthub.io/packages/helm/longhorn/longhorn for the
+    # current release and pin an exact version for a fully reproducible
+    # install.
+    version: ">=1.7.0"
+    repository: https://charts.longhorn.io

apps/longhorn/values.yaml

@@ -0,0 +1,22 @@
+# Values for the upstream Longhorn chart, nested under `longhorn:` (the
+# dependency's name in Chart.yaml).
+longhorn:
+  defaultSettings:
+    # Must match the mount path from the UserVolumeConfig in
+    # talos/patch-longhorn.yaml (/var/mnt/<name>) — this is what points
+    # Longhorn at the dedicated data disk instead of its own default path
+    # on the root filesystem, which on Talos is ephemeral/unsuited for
+    # real data anyway.
+    defaultDataPath: /var/mnt/longhorn
+    # Longhorn's own headroom settings, kept conservative: stop scheduling
+    # new replicas onto a disk once free space drops below these
+    # thresholds, so the cluster degrades gracefully instead of actually
+    # filling a disk.
+    storageMinimalAvailablePercentage: 25
+    storageReservedPercentageForDefaultDisk: 30
+  preUpgradeChecker:
+    # Longhorn's own pre-upgrade check runs as a Job that expects to reach
+    # an upgrade-responder service on the internet by default. Harmless to
+    # leave on, but pointless for a learning cluster and one less thing to
+    # explain — off by default here.
+    jobEnabled: false

apps/metallb/Chart.yaml

@@ -5,7 +5,7 @@
 # exists at this path, resolves the dependency, and syncs the combined
 # rendered output as one Application — exactly like any other app in
 # apps/. This is the real, working example of the Helm-based app pattern
-# mentioned in docs/07-adding-new-apps.md: use it as a template if you want
+# mentioned in docs/08-adding-new-apps.md: use it as a template if you want
 # to bring in another third-party chart later.
 apiVersion: v2
 name: metallb-app