# Argo CD — GitOps controller watching will/infrastructure on Gitea
# App manifests live in: servers/legion/apps/

resource "kubernetes_namespace" "argocd" {
  metadata {
    name = "argocd"
    labels = {
      managed-by = "terraform"
      tier       = "infrastructure"
    }
  }
}

resource "helm_release" "argocd" {
  name       = "argocd"
  namespace  = kubernetes_namespace.argocd.metadata[0].name
  repository = "https://argoproj.github.io/argo-helm"
  chart      = "argo-cd"
  version    = "7.8.0"

  values = [<<-YAML
    global:
      domain: argocd.${var.domain_suffix}

    server:
      ingress:
        enabled: true
        ingressClassName: traefik
        annotations:
          traefik.ingress.kubernetes.io/router.entrypoints: websecure
          cert-manager.io/cluster-issuer: letsencrypt-prod
        tls: true

    configs:
      params:
        server.insecure: true  # TLS terminated at Traefik
      repositories:
        gitea-infrastructure:
          url: http://10.43.1.53:3000/will/infrastructure.git
          name: infrastructure
          type: git
  YAML
  ]

  depends_on = [kubernetes_namespace.argocd, helm_release.cert_manager]
}

resource "kubernetes_ingress_v1" "argocd" {
  metadata {
    name      = "argocd"
    namespace = kubernetes_namespace.argocd.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = ["argocd.${var.domain_suffix}"]
      secret_name = "argocd-tls"
    }

    rule {
      host = "argocd.${var.domain_suffix}"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "argocd-server"
              port {
                number = 80
              }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.argocd, helm_release.cert_manager]
}