fix(argocd): use homelab-ca wildcard TLS instead of --insecure mode

terraform/argocd-bootstrap.tf

@@ -62,7 +62,8 @@ resource "helm_release" "argocd" {
       }
       server = {
         extraArgs = [
-          "--insecure"
+          "--tls-cert-file=/etc/argocd/server.crt",
+          "--tls-key-file=/etc/argocd/server.key"
         ]
         ingress = {
           enabled = true
@@ -76,8 +77,15 @@ resource "helm_release" "argocd" {
         }
         service = {
           type = "ClusterIP"
-          port = 80
+          port = 443
         }
+        volumeMounts = [
+          {
+            name      = "server-tls"
+            mountPath = "/etc/argocd"
+            readOnly  = true
+          }
+        ]
       }
       repoServer = {
         autoscaling = {
@@ -122,6 +130,15 @@ resource "helm_release" "argocd" {
           }
         ]
       }
+      volumes = [
+        {
+          name = "server-tls"
+          secret = {
+            secretName = "homelab-tls"
+            defaultMode = 420
+          }
+        }
+      ]
       controller = {
         replicas = 2
       }