From 69d2240cf43075830fba6e33516998f1dba1f560 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 15 Jul 2026 16:21:31 -0700
Subject: [PATCH] fix(argocd): use homelab-ca wildcard TLS instead of
 --insecure mode

---
 terraform/argocd-bootstrap.tf | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/terraform/argocd-bootstrap.tf b/terraform/argocd-bootstrap.tf
index 90e5678..eb619f6 100644
--- a/terraform/argocd-bootstrap.tf
+++ b/terraform/argocd-bootstrap.tf
@@ -62,7 +62,8 @@ resource "helm_release" "argocd" {
       }
       server = {
         extraArgs = [
-          "--insecure"
+          "--tls-cert-file=/etc/argocd/server.crt",
+          "--tls-key-file=/etc/argocd/server.key"
         ]
         ingress = {
           enabled = true
@@ -76,8 +77,15 @@ resource "helm_release" "argocd" {
         }
         service = {
           type = "ClusterIP"
-          port = 80
+          port = 443
         }
+        volumeMounts = [
+          {
+            name      = "server-tls"
+            mountPath = "/etc/argocd"
+            readOnly  = true
+          }
+        ]
       }
       repoServer = {
         autoscaling = {
@@ -122,6 +130,15 @@ resource "helm_release" "argocd" {
           }
         ]
       }
+      volumes = [
+        {
+          name = "server-tls"
+          secret = {
+            secretName = "homelab-tls"
+            defaultMode = 420
+          }
+        }
+      ]
       controller = {
         replicas = 2
       }