diff --git a/servers/legion/apps/.gitkeep b/servers/legion/apps/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/servers/legion/apps/README.md b/servers/legion/apps/README.md
new file mode 100644
index 0000000..cdcd22d
--- /dev/null
+++ b/servers/legion/apps/README.md
@@ -0,0 +1,3 @@
+# Legion Apps
+
+Argo CD watches this directory. Add Kubernetes manifests or Argo CD Application resources here.
diff --git a/servers/legion/argocd.tf b/servers/legion/argocd.tf
index 6f83af3..9fe8328 100644
--- a/servers/legion/argocd.tf
+++ b/servers/legion/argocd.tf
@@ -82,3 +82,57 @@ resource "kubernetes_ingress_v1" "argocd" {
 
   depends_on = [helm_release.argocd, helm_release.cert_manager]
 }
+
+# Gitea repo credentials for Argo CD
+# Label argocd.argoproj.io/secret-type=repository tells Argo CD to use this as a repo credential
+resource "kubernetes_secret" "argocd_gitea_repo" {
+  metadata {
+    name      = "argocd-repo-gitea-infrastructure"
+    namespace = kubernetes_namespace.argocd.metadata[0].name
+    labels = {
+      "argocd.argoproj.io/secret-type" = "repository"
+    }
+  }
+
+  data = {
+    type     = "git"
+    url      = "http://10.43.1.53:3000/will/infrastructure.git"
+    username = "will"
+    password = var.gitea_api_token
+  }
+
+  depends_on = [helm_release.argocd]
+}
+
+# Root application — watches servers/legion/apps/ for app manifests
+resource "kubernetes_manifest" "argocd_root_app" {
+  manifest = {
+    apiVersion = "argoproj.io/v1alpha1"
+    kind       = "Application"
+    metadata = {
+      name      = "legion-apps"
+      namespace = kubernetes_namespace.argocd.metadata[0].name
+    }
+    spec = {
+      project = "default"
+      source = {
+        repoURL        = "http://10.43.1.53:3000/will/infrastructure.git"
+        targetRevision = "main"
+        path           = "servers/legion/apps"
+      }
+      destination = {
+        server    = "https://kubernetes.default.svc"
+        namespace = "argocd"
+      }
+      syncPolicy = {
+        automated = {
+          prune    = true
+          selfHeal = true
+        }
+        syncOptions = ["CreateNamespace=true"]
+      }
+    }
+  }
+
+  depends_on = [helm_release.argocd, kubernetes_secret.argocd_gitea_repo]
+}
diff --git a/servers/legion/variables.tf b/servers/legion/variables.tf
index 8aabfc0..500a523 100644
--- a/servers/legion/variables.tf
+++ b/servers/legion/variables.tf
@@ -129,3 +129,9 @@ variable "gitea_webhook_secret" {
   type        = string
   sensitive   = true
 }
+
+variable "gitea_api_token" {
+  description = "Gitea API token for Argo CD repo access"
+  type        = string
+  sensitive   = true
+}