Add ingress-nginx

apps/ingress-nginx/Chart.yaml

@@ -0,0 +1,19 @@
+# An "umbrella" chart, same pattern as apps/metallb/ and apps/longhorn/:
+# declares a dependency on the upstream ingress-nginx chart. Argo CD detects
+# this as a Helm source because a Chart.yaml exists at this path.
+#
+# See docs/11-ingress.md for why this exists: one shared LoadBalancer
+# address routing many hostnames, instead of every app needing its own
+# MetalLB address.
+apiVersion: v2
+name: ingress-nginx-app
+description: Installs ingress-nginx, routing many hostnames through one shared LoadBalancer address
+version: 0.1.0
+dependencies:
+  - name: ingress-nginx
+    # A version range rather than an exact pin, so this doesn't silently go
+    # stale. Check https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx
+    # for the current release and pin an exact version for a fully
+    # reproducible install.
+    version: ">=4.11.0"
+    repository: https://kubernetes.github.io/ingress-nginx

apps/ingress-nginx/values.yaml

@@ -0,0 +1,21 @@
+# Values for the upstream ingress-nginx chart, nested under
+# `ingress-nginx:` (the dependency's name in Chart.yaml).
+ingress-nginx:
+  controller:
+    service:
+      type: LoadBalancer
+      annotations:
+        # Requests this specific address from MetalLB's BGP pool (see
+        # docs/05-metallb.md) so it stays predictable across rebuilds.
+        # Must fall inside apps/metallb/templates/ipaddresspool.yaml's
+        # range, or MetalLB will never satisfy the request.
+        metallb.io/loadBalancerIPs: "10.10.60.12"
+    # ingress-nginx's default Pod Security posture (no hostNetwork, no
+    # hostPath, only the baseline-allowed NET_BIND_SERVICE capability to
+    # bind ports 80/443) already fits Kubernetes' baseline profile, unlike
+    # MetalLB or Longhorn. No managedNamespaceMetadata override needed here.
+    ingressClassResource:
+      # Every Ingress resource in this cluster that doesn't name a class
+      # explicitly uses this one automatically \u2014 the same "no
+      # storageClassName needed" convenience Longhorn gives PVCs.
+      default: true