From ec5b2ab5f17a6c3529ed330bfb9d1b37c02c4f10 Mon Sep 17 00:00:00 2001
From: Ian Keane <ian@keane.sh>
Date: Mon, 17 Aug 2026 10:29:21 -0400
Subject: [PATCH] Consolidate bootstrapping steps, add cert-manager

---
 Makefile                                 |  6 ++-
 README.md                                | 28 +++++++-------
 charts/argocd/values.yaml                |  4 +-
 charts/cert-manager/cluster-issuers.yaml | 29 ++++++++++++++
 charts/cert-manager/values.yaml          |  2 +
 manifests/cert-manager.yaml              | 49 ++++++++++++++++++++++++
 scripts/post-apply.sh                    | 26 +++++++++++++
 7 files changed, 127 insertions(+), 17 deletions(-)
 create mode 100644 charts/cert-manager/cluster-issuers.yaml
 create mode 100644 charts/cert-manager/values.yaml
 create mode 100644 manifests/cert-manager.yaml
 create mode 100755 scripts/post-apply.sh

diff --git a/Makefile b/Makefile
index 0b3159e..e384bf8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: init plan apply destroy kubeconfig talosconfig argocd-password bootstrap decrypt
+.PHONY: init plan apply destroy kubeconfig talosconfig argocd-password bootstrap decrypt post-apply
 
 SECRET=dumpnet/cluster
 TF_DIR=terraform
@@ -56,3 +56,7 @@ decrypt:
 	  fi; \
 	done
 	@echo "Decrypted files are in /tmp/ - they will not persist after reboot"
+
+# Run all post-apply steps (run once after fresh cluster creation)
+post-apply:
+	scripts/post-apply.sh
diff --git a/README.md b/README.md
index f7e664d..d1ff5a0 100644
--- a/README.md
+++ b/README.md
@@ -70,30 +70,25 @@ This will:
 - Create Route53 DNS records pointing to the EIP
 - Store all credentials in AWS Secrets Manager (`dumpnet/cluster`)
 
-### 4. Configure local access
+### 4. Post-apply bootstrap (one-time)
 
 ```bash
-make kubeconfig    # merges kubeconfig into ~/.kube/config
-make talosconfig   # merges talosconfig into ~/.talos/config
+make post-apply
 ```
 
-These pull from Secrets Manager and are safe to run repeatedly.
+This script:
+- Fetches kubeconfig and talosconfig from Secrets Manager
+- Waits for the node to be ready
+- Imports the ingress-nginx namespace into Terraform state
+- Applies the ArgoCD App of Apps
 
-### 5. Bootstrap ArgoCD App of Apps
-
-```bash
-make bootstrap
-```
-
-One-time step that hands control of all apps to ArgoCD. After this, everything in `manifests/` is managed automatically.
-
-### 6. Get ArgoCD password
+### 5. Get ArgoCD password
 
 ```bash
 make argocd-password
 ```
 
-Then log in at https://argocd.dumpnet.chat
+Then log in at https://argocd.dumpnet.chat — ArgoCD will finish deploying ingress-nginx and metrics-server automatically.
 
 ## Day-to-Day
 
@@ -109,7 +104,8 @@ Then log in at https://argocd.dumpnet.chat
 | `make apply` | Create/update cluster infrastructure |
 | `make plan` | Preview infrastructure changes |
 | `make destroy` | Tear down everything |
-| `make bootstrap` | Apply App of Apps (one-time) |
+| `make post-apply` | One-time bootstrap after fresh cluster creation |
+| `make bootstrap` | Apply App of Apps only |
 | `make kubeconfig` | Pull kubeconfig from Secrets Manager |
 | `make talosconfig` | Pull talosconfig from Secrets Manager |
 | `make argocd-password` | Print ArgoCD admin password |
@@ -120,6 +116,8 @@ Then log in at https://argocd.dumpnet.chat
 ```
 dumpnet-argo/
 ├── Makefile                  # top-level commands
+├── scripts/
+│   └── post-apply.sh         # one-time bootstrap after fresh cluster
 ├── apps/
 │   └── apps.yaml             # ArgoCD App of Apps root
 ├── manifests/                # ArgoCD Application manifests
diff --git a/charts/argocd/values.yaml b/charts/argocd/values.yaml
index 1abb781..cbdc4d9 100644
--- a/charts/argocd/values.yaml
+++ b/charts/argocd/values.yaml
@@ -6,6 +6,8 @@ server:
     enabled: true
     ingressClassName: nginx
     hostname: argocd.dumpnet.chat
-    tls: false
+    tls: true
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-prod
   extraArgs:
     - --insecure
diff --git a/charts/cert-manager/cluster-issuers.yaml b/charts/cert-manager/cluster-issuers.yaml
new file mode 100644
index 0000000..b20dff1
--- /dev/null
+++ b/charts/cert-manager/cluster-issuers.yaml
@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: dumpnetcerts@keane.sh
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: nginx
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: dumpnetcerts@keane.sh
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: nginx
diff --git a/charts/cert-manager/values.yaml b/charts/cert-manager/values.yaml
new file mode 100644
index 0000000..c526c4b
--- /dev/null
+++ b/charts/cert-manager/values.yaml
@@ -0,0 +1,2 @@
+crds:
+  enabled: true
diff --git a/manifests/cert-manager.yaml b/manifests/cert-manager.yaml
new file mode 100644
index 0000000..f0263b5
--- /dev/null
+++ b/manifests/cert-manager.yaml
@@ -0,0 +1,49 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://charts.jetstack.io
+      chart: cert-manager
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/charts/cert-manager/values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager-issuers
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/cert-manager
+    directory:
+      include: "cluster-issuers.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/scripts/post-apply.sh b/scripts/post-apply.sh
new file mode 100755
index 0000000..5cf3263
--- /dev/null
+++ b/scripts/post-apply.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+# Post-apply bootstrap script
+# Run this once after 'make apply' completes on a fresh cluster
+
+set -e
+
+echo "==> Fetching kubeconfig..."
+make kubeconfig
+
+echo "==> Fetching talosconfig..."
+make talosconfig
+
+echo "==> Waiting for cluster to be ready..."
+kubectl wait --for=condition=Ready node --all --timeout=120s
+
+echo "==> Importing ingress-nginx namespace into Terraform state (if needed)..."
+cd terraform
+terraform import kubernetes_namespace.ingress_nginx ingress-nginx 2>/dev/null || echo "Already in state, skipping"
+cd ..
+
+echo "==> Bootstrapping ArgoCD App of Apps..."
+make bootstrap
+
+echo ""
+echo "Done! ArgoCD should be available at https://argocd.dumpnet.chat shortly."
+echo "Get your password with: make argocd-password"