Add Argo CD — GitOps controller for legion app deployments

servers/legion/argocd.tf

@@ -0,0 +1,84 @@
+# Argo CD — GitOps controller watching will/infrastructure on Gitea
+# App manifests live in: servers/legion/apps/
+
+resource "kubernetes_namespace" "argocd" {
+  metadata {
+    name = "argocd"
+    labels = {
+      managed-by = "terraform"
+      tier       = "infrastructure"
+    }
+  }
+}
+
+resource "helm_release" "argocd" {
+  name       = "argocd"
+  namespace  = kubernetes_namespace.argocd.metadata[0].name
+  repository = "https://argoproj.github.io/argo-helm"
+  chart      = "argo-cd"
+  version    = "7.8.0"
+
+  values = [<<-YAML
+    global:
+      domain: argocd.${var.domain_suffix}
+
+    server:
+      ingress:
+        enabled: true
+        ingressClassName: traefik
+        annotations:
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        tls: true
+
+    configs:
+      params:
+        server.insecure: true  # TLS terminated at Traefik
+      repositories:
+        gitea-infrastructure:
+          url: http://10.43.1.53:3000/will/infrastructure.git
+          name: infrastructure
+          type: git
+  YAML
+  ]
+
+  depends_on = [kubernetes_namespace.argocd, helm_release.cert_manager]
+}
+
+resource "kubernetes_ingress_v1" "argocd" {
+  metadata {
+    name      = "argocd"
+    namespace = kubernetes_namespace.argocd.metadata[0].name
+    annotations = {
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["argocd.${var.domain_suffix}"]
+      secret_name = "argocd-tls"
+    }
+
+    rule {
+      host = "argocd.${var.domain_suffix}"
+      http {
+        path {
+          path      = "/"
+          path_type = "Prefix"
+          backend {
+            service {
+              name = "argocd-server"
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [helm_release.argocd, helm_release.cert_manager]
+}