# Argo CD — GitOps controller watching will/infrastructure on Gitea
# App manifests live in: servers/legion/apps/

resource "kubernetes_namespace" "argocd" {
  metadata {
    name = "argocd"
    labels = {
      managed-by = "terraform"
      tier       = "infrastructure"
    }
  }
}

resource "helm_release" "argocd" {
  name       = "argocd"
  namespace  = kubernetes_namespace.argocd.metadata[0].name
  repository = "https://argoproj.github.io/argo-helm"
  chart      = "argo-cd"
  version    = "7.8.0"

  values = [<<-YAML
    global:
      domain: argocd.${var.infra_domain}

    server:
      ingress:
        enabled: true
        ingressClassName: traefik
        annotations:
          traefik.ingress.kubernetes.io/router.entrypoints: websecure
          cert-manager.io/cluster-issuer: letsencrypt-prod
        tls: true

    configs:
      params:
        server.insecure: true  # TLS terminated at Traefik
      repositories:
        gitea-infrastructure:
          url: http://gitea.git.svc.cluster.local:3000/will/infrastructure.git
          name: infrastructure
          type: git
  YAML
  ]

  depends_on = [kubernetes_namespace.argocd, helm_release.cert_manager]
}

resource "kubernetes_ingress_v1" "argocd" {
  metadata {
    name      = "argocd"
    namespace = kubernetes_namespace.argocd.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = ["argocd.${var.infra_domain}"]
      secret_name = "argocd-tls"
    }

    rule {
      host = "argocd.${var.infra_domain}"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "argocd-server"
              port {
                number = 80
              }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.argocd, helm_release.cert_manager]
}

# Gitea repo credentials for Argo CD (internal cluster IP)
# Label argocd.argoproj.io/secret-type=repository tells Argo CD to use this as a repo credential
resource "kubernetes_secret" "argocd_gitea_repo" {
  metadata {
    name      = "argocd-repo-gitea-infrastructure"
    namespace = kubernetes_namespace.argocd.metadata[0].name
    labels = {
      "argocd.argoproj.io/secret-type" = "repository"
    }
  }

  data = {
    type     = "git"
    url      = "http://gitea.git.svc.cluster.local:3000/will/infrastructure.git"
    username = "will"
    password = var.gitea_api_token
  }

  depends_on = [helm_release.argocd]
}

# Gitea repo credentials via public hostname (for apps referencing git.neuralplatform.ai)
resource "kubernetes_secret" "argocd_gitea_repo_public" {
  metadata {
    name      = "argocd-repo-gitea-infrastructure-public"
    namespace = kubernetes_namespace.argocd.metadata[0].name
    labels = {
      "argocd.argoproj.io/secret-type" = "repository"
    }
  }

  data = {
    type     = "git"
    url      = "https://git.neuralplatform.ai/will/infrastructure.git"
    username = "will"
    password = var.gitea_api_token
  }

  depends_on = [helm_release.argocd]
}

# Root application — watches servers/legion/apps/ for app manifests
resource "kubernetes_manifest" "argocd_root_app" {
  manifest = {
    apiVersion = "argoproj.io/v1alpha1"
    kind       = "Application"
    metadata = {
      name      = "legion-apps"
      namespace = kubernetes_namespace.argocd.metadata[0].name
    }
    spec = {
      project = "default"
      source = {
        repoURL        = "http://gitea.git.svc.cluster.local:3000/will/infrastructure.git"
        targetRevision = "main"
        path           = "servers/legion/apps"
      }
      destination = {
        server    = "https://kubernetes.default.svc"
        namespace = "argocd"
      }
      syncPolicy = {
        automated = {
          prune    = true
          selfHeal = true
        }
        syncOptions = ["CreateNamespace=true"]
      }
    }
  }

  field_manager {
    force_conflicts = true
  }

  depends_on = [helm_release.argocd, kubernetes_secret.argocd_gitea_repo]
}