homelab/terraform/argocd-bootstrap.tf

resource "kubernetes_namespace" "argocd" {
  metadata {
    name = "argocd"
    labels = {
      "pod-security.kubernetes.io/enforce"         = "baseline"
      "pod-security.kubernetes.io/enforce-version" = "latest"
    }
  }
}

# Copy homelab-ca-secret from cert-manager to argocd namespace
# (Required for repo-server pod to verify self-signed forgejo TLS)
resource "null_resource" "copy_ca_secret_to_argocd" {
  provisioner "local-exec" {
    command = <<-EOT
      kubectl get secret homelab-ca-secret -n cert-manager -o yaml | \
        sed 's/namespace: cert-manager/namespace: argocd/' | \
        kubectl apply -f -
    EOT
  }

  depends_on = [
    kubernetes_namespace.argocd
  ]
}

resource "helm_release" "argocd" {
  name       = "argocd"
  repository = local.helm_repos["argo"]
  chart      = "argo-cd"
  version    = "7.3.3"
  namespace  = kubernetes_namespace.argocd.metadata[0].name

  values = [
    yamlencode({
      global = {
        domain = "argocd.${var.cluster_domain}"
      }
      configs = {
        params = {
          "application.instanceLabelKey" = "argocd.argoproj.io/instance"
        }
        rbac = {
          "policy.default" = "role:readonly"
        }
        cmp = {
          create = true
          plugins = {
            sops = {
              allowConcurrency = false
              discover = {
                fileName = "*.enc.yaml"
              }
              generate = {
                command = ["sh", "-c"]
                args    = ["sops -d \"$ARGOCD_ENV_FILE_PATH\""]
              }
              lockRepo = false
            }
          }
        }
      }
      server = {
        extraArgs = [
          "--tls-cert-file=/etc/argocd/server.crt",
          "--tls-key-file=/etc/argocd/server.key"
        ]
        ingress = {
          enabled = true
          hosts = [
            "argocd.${var.cluster_domain}"
          ]
          annotations = {
            "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
          }
          ingressClassName = "nginx"
        }
        service = {
          type = "ClusterIP"
          port = 443
        }
        volumeMounts = [
          {
            name      = "server-tls"
            mountPath = "/etc/argocd"
            readOnly  = true
          }
        ]
      }
      repoServer = {
        autoscaling = {
          enabled     = true
          minReplicas = 2
        }
        env = [
          {
            name  = "GIT_SSL_CAINFO"
            value = "/etc/ssl/certs/homelab-ca.crt"
          },
          {
            name  = "SOPS_AGE_KEY_FILE"
            value = "/home/argocd/.sops/keys.txt"
          }
        ]
        volumes = [
          {
            name = "homelab-ca"
            secret = {
              secretName = "homelab-ca-secret"
            }
          },
          {
            name = "sops-age"
            secret = {
              secretName  = "sops-age"
              defaultMode = 384
            }
          }
        ]
        volumeMounts = [
          {
            name      = "homelab-ca"
            mountPath = "/etc/ssl/certs/homelab-ca.crt"
            subPath   = "tls.crt"
          },
          {
            name      = "sops-age"
            mountPath = "/home/argocd/.sops"
            readOnly  = true
          }
        ]
      }
      volumes = [
        {
          name = "server-tls"
          secret = {
            secretName  = "homelab-tls"
            defaultMode = 420
          }
        }
      ]
      controller = {
        replicas = 2
      }
    })
  ]

  depends_on = [
    kubernetes_namespace.argocd,
    null_resource.copy_ca_secret_to_argocd
  ]

  # Note: lifecycle.ignore_changes removed to allow CA cert update
  # This allows TF to inject the homelab-ca-secret for TLS verification
}

resource "kubernetes_manifest" "argocd_project" {
  manifest = {
    apiVersion = "argoproj.io/v1alpha1"
    kind       = "AppProject"
    metadata = {
      name      = "homelab"
      namespace = kubernetes_namespace.argocd.metadata[0].name
    }
    spec = {
      sourceRepos = [
        "https://forgejo.riotpiao.homelab.com/riotpiao.com/*",
        "https://charts.goauthentik.io",
        "https://prometheus-community.github.io/helm-charts",
        "https://grafana.github.io/helm-charts",
        "https://grafana.github.io/loki/charts",
        "https://charts.min.io/",
        "https://strimzi.io/charts/",
        "https://open-telemetry.github.io/opentelemetry-helm-charts"
      ]
      destinations = [
        {
          server    = "https://kubernetes.default.svc"
          namespace = "*"
        }
      ]
      clusterResourceWhitelist = [
        {
          group = "*"
          kind  = "*"
        }
      ]
    }
  }

  field_manager {
    name = "terraform"
  }

  depends_on = [
    helm_release.argocd
  ]
}

resource "kubernetes_manifest" "argocd_root_app" {
  manifest = {
    apiVersion = "argoproj.io/v1alpha1"
    kind       = "Application"
    metadata = {
      name      = "homelab-root"
      namespace = kubernetes_namespace.argocd.metadata[0].name
    }
    spec = {
      project = kubernetes_manifest.argocd_project.manifest.metadata.name
      source = {
        repoURL        = "https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git"
        targetRevision = "main"
        path           = "k8s/argocd/apps"
        directory = {
          recurse = true
        }
      }
      destination = {
        server    = "https://kubernetes.default.svc"
        namespace = kubernetes_namespace.argocd.metadata[0].name
      }
      syncPolicy = {
        automated = {
          prune    = true
          selfHeal = true
        }
        syncOptions = [
          "CreateNamespace=true"
        ]
      }
    }
  }

  field_manager {
    name = "terraform"
  }

  depends_on = [
    kubernetes_manifest.argocd_project
  ]
}