Add Hajimari service dashboard (#73)

## Summary
- Add Hajimari as a service dashboard/start page at `go.ops.eblu.me`
- Auto-discovers k8s services from ingress annotations
- Custom apps for non-k8s services: Forgejo, Registry, Sifaka NAS
- Add `nas.ops.eblu.me` Caddy proxy to Synology dashboard

## Services Configured

**Auto-discovered (k8s ingresses with hajimari.io annotations):**
- Grafana, ArgoCD, Prometheus, Loki (Observability)
- Miniflux, Kiwix, Transmission, TeslaMate, Immich (Apps)
- PyPI/devpi (Infrastructure)

**Custom apps (non-k8s):**
- Forgejo (forge.ops.eblu.me)
- Registry (registry.ops.eblu.me)
- Sifaka NAS (nas.ops.eblu.me)

**Bookmarks:**
- Tailscale Admin, 1Password, Pulumi

## Deployment and Testing
- [ ] Sync `apps` application to pick up new Hajimari Application
- [ ] Sync `hajimari` application
- [ ] Run `mise run provision-indri -- --tags caddy` for go/nas proxy entries
- [ ] Re-sync all k8s apps with hajimari annotations (or wait for natural drift)
- [ ] Verify https://go.ops.eblu.me shows dashboard with all services

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/73

argocd/apps/hajimari.yaml

@@ -0,0 +1,32 @@
+# Hajimari - Service Dashboard / Start Page
+#
+# Using upstream Helm chart from https://hajimari.io
+#
+# Auto-discovers k8s services via ingress annotations and displays
+# custom apps for non-k8s services (Forge, Registry, NAS).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: hajimari
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    # Helm chart from upstream repo
+    - repoURL: https://hajimari.io
+      chart: hajimari
+      targetRevision: 2.0.2
+      helm:
+        releaseName: hajimari
+        valueFiles:
+          - $values/argocd/manifests/hajimari/values.yaml
+    # Values from our git repo
+    - repoURL: ssh://forgejo@forge.ops.eblu.me:2222/eblume/blumeops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: hajimari
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/manifests/argocd/service-tailscale.yaml

@@ -11,6 +11,12 @@ metadata:
   namespace: argocd
   annotations:
     tailscale.com/proxy-class: "default"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://argocd.ops.eblu.me"
+    hajimari.io/icon: "simple-icons:argo"
+    hajimari.io/appName: "ArgoCD"
+    hajimari.io/group: "Infrastructure"
+    hajimari.io/info: "GitOps continuous delivery"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/devpi/ingress-tailscale.yaml

@@ -5,6 +5,12 @@ metadata:
   namespace: devpi
   annotations:
     tailscale.com/proxy-class: "default"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://pypi.ops.eblu.me"
+    hajimari.io/icon: "simple-icons:pypi"
+    hajimari.io/appName: "PyPI"
+    hajimari.io/group: "Infrastructure"
+    hajimari.io/info: "Python package cache (devpi)"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/grafana-config/ingress-tailscale.yaml

@@ -9,6 +9,12 @@ metadata:
   namespace: monitoring
   annotations:
     tailscale.com/proxy-class: "default"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://grafana.ops.eblu.me"
+    hajimari.io/icon: "simple-icons:grafana"
+    hajimari.io/appName: "Grafana"
+    hajimari.io/group: "Observability"
+    hajimari.io/info: "Dashboards & metrics visualization"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/hajimari/values.yaml

@@ -0,0 +1,66 @@
+# Hajimari values for blumeops
+# Service dashboard at go.ops.eblu.me
+
+# Page settings
+hajimari:
+  title: BlumeOps
+  name: Erich
+  defaultEnable: true
+
+  # Discover ingresses from all namespaces
+  namespaceSelector:
+    any: true
+
+  # Non-k8s services (hosted on indri or LAN)
+  customApps:
+    - group: Infrastructure
+      apps:
+        - name: Forgejo
+          url: https://forge.ops.eblu.me
+          icon: simple-icons:forgejo
+          info: Git forge & CI/CD
+        - name: Registry
+          url: https://registry.ops.eblu.me
+          icon: mdi:docker
+          info: Container registry (Zot)
+        - name: Sifaka NAS
+          url: https://nas.ops.eblu.me
+          icon: simple-icons:synology
+          info: Synology NAS dashboard
+
+  # Useful external bookmarks
+  globalBookmarks:
+    - group: Docs
+      bookmarks:
+        - name: Tailscale Admin
+          url: https://login.tailscale.com/admin
+        - name: 1Password
+          url: https://my.1password.com
+        - name: Pulumi
+          url: https://app.pulumi.com/eblume/blumeops-tailnet
+
+# Service account for reading ingresses across namespaces
+serviceAccount:
+  create: true
+
+# Tailscale Ingress - exposes at go.tail8d86e.ts.net
+# Caddy will proxy go.ops.eblu.me to this
+ingress:
+  main:
+    enabled: true
+    ingressClassName: tailscale
+    annotations:
+      hajimari.io/enable: "false"
+    hosts:
+      - host: go
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - hosts:
+          - go
+
+# No persistence needed - config is in values.yaml
+persistence:
+  data:
+    enabled: false

argocd/manifests/immich/ingress-tailscale.yaml

@@ -8,6 +8,12 @@ metadata:
   namespace: immich
   annotations:
     tailscale.com/funnel: "false"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://photos.ops.eblu.me"
+    hajimari.io/icon: "mdi:image-multiple"
+    hajimari.io/appName: "Immich"
+    hajimari.io/group: "Apps"
+    hajimari.io/info: "Photo management"
 spec:
   ingressClassName: tailscale
   rules:

argocd/manifests/kiwix/ingress-tailscale.yaml

@@ -6,6 +6,12 @@ metadata:
   namespace: kiwix
   annotations:
     tailscale.com/proxy-class: "default"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://kiwix.ops.eblu.me"
+    hajimari.io/icon: "mdi:wikipedia"
+    hajimari.io/appName: "Kiwix"
+    hajimari.io/group: "Apps"
+    hajimari.io/info: "Offline Wikipedia & ZIM archives"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/loki/ingress-tailscale.yaml

@@ -7,6 +7,12 @@ metadata:
   namespace: monitoring
   annotations:
     tailscale.com/funnel: "false"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://loki.ops.eblu.me"
+    hajimari.io/icon: "mdi:text-box-search"
+    hajimari.io/appName: "Loki"
+    hajimari.io/group: "Observability"
+    hajimari.io/info: "Log aggregation"
 spec:
   ingressClassName: tailscale
   rules:

argocd/manifests/miniflux/ingress-tailscale.yaml

@@ -5,6 +5,12 @@ metadata:
   namespace: miniflux
   annotations:
     tailscale.com/proxy-class: "default"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://feed.ops.eblu.me"
+    hajimari.io/icon: "mdi:rss"
+    hajimari.io/appName: "Miniflux"
+    hajimari.io/group: "Apps"
+    hajimari.io/info: "RSS feed reader"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/prometheus/ingress-tailscale.yaml

@@ -7,6 +7,12 @@ metadata:
   namespace: monitoring
   annotations:
     tailscale.com/funnel: "false"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://prometheus.ops.eblu.me"
+    hajimari.io/icon: "simple-icons:prometheus"
+    hajimari.io/appName: "Prometheus"
+    hajimari.io/group: "Observability"
+    hajimari.io/info: "Metrics collection & storage"
 spec:
   ingressClassName: tailscale
   rules:

argocd/manifests/teslamate/ingress-tailscale.yaml

@@ -5,6 +5,12 @@ metadata:
   namespace: teslamate
   annotations:
     tailscale.com/proxy-class: "default"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://tesla.ops.eblu.me"
+    hajimari.io/icon: "simple-icons:tesla"
+    hajimari.io/appName: "TeslaMate"
+    hajimari.io/group: "Apps"
+    hajimari.io/info: "Tesla data logger"
 spec:
   ingressClassName: tailscale
   defaultBackend:

argocd/manifests/torrent/ingress-tailscale.yaml

@@ -6,6 +6,12 @@ metadata:
   namespace: torrent
   annotations:
     tailscale.com/proxy-class: "default"
+    hajimari.io/enable: "true"
+    hajimari.io/url: "https://torrent.ops.eblu.me"
+    hajimari.io/icon: "mdi:download"
+    hajimari.io/appName: "Transmission"
+    hajimari.io/group: "Apps"
+    hajimari.io/info: "BitTorrent daemon"
 spec:
   ingressClassName: tailscale
   defaultBackend: