From 13e71fd4913e84eb7bfc376c1f9bc1ba4ce28520 Mon Sep 17 00:00:00 2001
From: Will Anderson <andersonwilliam85@gmail.com>
Date: Mon, 23 Mar 2026 07:52:07 -0500
Subject: [PATCH] =?UTF-8?q?Add=20Argo=20CD=20=E2=80=94=20GitOps=20controll?=
 =?UTF-8?q?er=20for=20legion=20app=20deployments?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 servers/legion/argocd.tf | 84 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 servers/legion/argocd.tf

diff --git a/servers/legion/argocd.tf b/servers/legion/argocd.tf
new file mode 100644
index 0000000..d2d9b93
--- /dev/null
+++ b/servers/legion/argocd.tf
@@ -0,0 +1,84 @@
+# Argo CD — GitOps controller watching will/infrastructure on Gitea
+# App manifests live in: servers/legion/apps/
+
+resource "kubernetes_namespace" "argocd" {
+  metadata {
+    name = "argocd"
+    labels = {
+      managed-by = "terraform"
+      tier       = "infrastructure"
+    }
+  }
+}
+
+resource "helm_release" "argocd" {
+  name       = "argocd"
+  namespace  = kubernetes_namespace.argocd.metadata[0].name
+  repository = "https://argoproj.github.io/argo-helm"
+  chart      = "argo-cd"
+  version    = "7.8.0"
+
+  values = [<<-YAML
+    global:
+      domain: argocd.${var.domain_suffix}
+
+    server:
+      ingress:
+        enabled: true
+        ingressClassName: traefik
+        annotations:
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        tls: true
+
+    configs:
+      params:
+        server.insecure: true  # TLS terminated at Traefik
+      repositories:
+        gitea-infrastructure:
+          url: http://10.43.1.53:3000/will/infrastructure.git
+          name: infrastructure
+          type: git
+  YAML
+  ]
+
+  depends_on = [kubernetes_namespace.argocd, helm_release.cert_manager]
+}
+
+resource "kubernetes_ingress_v1" "argocd" {
+  metadata {
+    name      = "argocd"
+    namespace = kubernetes_namespace.argocd.metadata[0].name
+    annotations = {
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["argocd.${var.domain_suffix}"]
+      secret_name = "argocd-tls"
+    }
+
+    rule {
+      host = "argocd.${var.domain_suffix}"
+      http {
+        path {
+          path      = "/"
+          path_type = "Prefix"
+          backend {
+            service {
+              name = "argocd-server"
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [helm_release.argocd, helm_release.cert_manager]
+}