dumpnet-argo/terraform/argocd.tf

# Generate ArgoCD admin password
resource "random_password" "argocd_admin" {
  length           = 24
  special          = true
  override_special = "!#$%&*()-_=+[]{}?"
}

resource "random_password" "postgres" {
  length  = 32
  special = false
}

resource "random_password" "kan_auth" {
  length  = 32
  special = false
}

# Single secrets manager secret for all cluster secrets
resource "aws_secretsmanager_secret" "dumpnet" {
  name        = var.cluster_name
  description = "All ${var.cluster_name} secrets"
}

resource "aws_secretsmanager_secret_version" "dumpnet" {
  secret_id = aws_secretsmanager_secret.dumpnet.id
  secret_string = jsonencode({
    cluster = {
      argocd_admin_password = random_password.argocd_admin.result
      talosconfig           = data.talos_client_configuration.this.talos_config
      kubeconfig            = talos_cluster_kubeconfig.this.kubeconfig_raw
    }
    postgres = {
      password = random_password.postgres.result
    }
    kan = {
      better_auth_secret = random_password.kan_auth.result
    }
  })
}

# Install ArgoCD via Helm
resource "helm_release" "argocd" {
  name             = "argocd"
  repository       = "https://argoproj.github.io/argo-helm"
  chart            = "argo-cd"
  namespace        = "argocd"
  create_namespace = true

  set {
    name  = "configs.secret.argocdServerAdminPassword"
    value = bcrypt(random_password.argocd_admin.result)
  }

  depends_on = [talos_cluster_kubeconfig.this]
}