# Generate ArgoCD admin password
resource "random_password" "argocd_admin" {
  length           = 24
  special          = true
  override_special = "!#$%&*()-_=+[]{}?"
}

# Store secrets in AWS Secrets Manager
resource "aws_secretsmanager_secret" "dumpnet" {
  name        = "dumpnet/cluster"
  description = "Dumpnet cluster secrets"
}

resource "aws_secretsmanager_secret_version" "dumpnet" {
  secret_id = aws_secretsmanager_secret.dumpnet.id
  secret_string = jsonencode({
    argocd_admin_password = random_password.argocd_admin.result
    talosconfig           = data.talos_client_configuration.this.talos_config
    kubeconfig            = talos_cluster_kubeconfig.this.kubeconfig_raw
  })
}

# Install ArgoCD via Helm
resource "helm_release" "argocd" {
  name             = "argocd"
  repository       = "https://argoproj.github.io/argo-helm"
  chart            = "argo-cd"
  namespace        = "argocd"
  create_namespace = true

  set {
    name  = "configs.secret.argocdServerAdminPassword"
    value = bcrypt(random_password.argocd_admin.result)
  }

  depends_on = [talos_cluster_kubeconfig.this]
}