feat(minio): migrate to official MinIO Operator chart, TF-owned

terraform/argocd-bootstrap.tf

@@ -8,6 +8,22 @@ resource "kubernetes_namespace" "argocd" {
   }
 }
 
+# Copy homelab-ca-secret from cert-manager to argocd namespace
+# (Required for repo-server pod to verify self-signed forgejo TLS)
+resource "null_resource" "copy_ca_secret_to_argocd" {
+  provisioner "local-exec" {
+    command = <<-EOT
+      kubectl get secret homelab-ca-secret -n cert-manager -o yaml | \
+        sed 's/namespace: cert-manager/namespace: argocd/' | \
+        kubectl apply -f -
+    EOT
+  }
+
+  depends_on = [
+    kubernetes_namespace.argocd
+  ]
+}
+
 resource "helm_release" "argocd" {
   name       = "argocd"
   repository = local.helm_repos["argo"]
@@ -37,6 +53,14 @@ resource "helm_release" "argocd" {
           hosts = [
             "argocd.${var.cluster_domain}"
           ]
+          annotations = {
+            "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
+          }
+          ingressClassName = "nginx"
+        }
+        service = {
+          type = "ClusterIP"
+          port = 80
         }
       }
       repoServer = {
@@ -44,6 +68,12 @@ resource "helm_release" "argocd" {
           enabled     = true
           minReplicas = 2
         }
+        env = [
+          {
+            name  = "GIT_SSL_CAINFO"
+            value = "/etc/ssl/certs/homelab-ca.crt"
+          }
+        ]
         volumes = [
           {
             name = "homelab-ca"
@@ -67,14 +97,12 @@ resource "helm_release" "argocd" {
   ]
 
   depends_on = [
-    kubernetes_namespace.argocd
+    kubernetes_namespace.argocd,
+    null_resource.copy_ca_secret_to_argocd
   ]
 
-  lifecycle {
-    ignore_changes = [
-      values
-    ]
-  }
+  # Note: lifecycle.ignore_changes removed to allow CA cert update
+  # This allows TF to inject the homelab-ca-secret for TLS verification
 }
 
 resource "kubernetes_manifest" "argocd_project" {