apiVersion: batch/v1
kind: Job
metadata:
  name: terraform-apply
  namespace: argocd
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: terraform-apply
      containers:
      - name: terraform
        image: hashicorp/terraform:latest
        command: ["/bin/sh", "-c"]
        args:
        - |
          set -e

          echo "=== Terraform Apply Hook (ArgoCD PostSync) ==="

          # Clone repo
          git clone --depth 1 https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git /repo
          cd /repo/terraform

          # Set S3 credentials
          export AWS_ACCESS_KEY_ID=$(cat /run/secrets/s3/AWS_ACCESS_KEY_ID)
          export AWS_SECRET_ACCESS_KEY=$(cat /run/secrets/s3/AWS_SECRET_ACCESS_KEY)
          export AWS_ENDPOINT_URL=$(cat /run/secrets/s3/AWS_ENDPOINT_URL)

          # Initialize and apply
          echo "Initializing Terraform..."
          terraform init

          echo "Planning Terraform changes..."
          terraform plan -out=tfplan

          echo "Applying Terraform..."
          terraform apply -auto-approve tfplan

          echo "✓ Terraform apply complete"
        volumeMounts:
        - name: s3-creds
          mountPath: /run/secrets/s3
          readOnly: true
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "1Gi"
            cpu: "1"
      volumes:
      - name: s3-creds
        projected:
          sources:
          - secret:
              name: terraform-s3-creds
              items:
              - key: AWS_ACCESS_KEY_ID
                path: AWS_ACCESS_KEY_ID
              - key: AWS_SECRET_ACCESS_KEY
                path: AWS_SECRET_ACCESS_KEY
              - key: AWS_ENDPOINT_URL
                path: AWS_ENDPOINT_URL
      restartPolicy: Never