home-services/terraform/main.tf

provider "talos" {}

provider "kubernetes" {
  host                   = talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.host
  client_certificate     = base64decode(talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.client_certificate)
  client_key             = base64decode(talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.client_key)
  cluster_ca_certificate = base64decode(talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.ca_certificate)
}

provider "helm" {
  kubernetes {
    host                   = talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.host
    client_certificate     = base64decode(talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.client_certificate)
    client_key             = base64decode(talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.client_key)
    cluster_ca_certificate = base64decode(talos_cluster_kubeconfig.cluster.kubernetes_client_configuration.ca_certificate)
  }
}

locals {
  nodes = {
    for node in var.nodes : node.name => node
  }

  bootstrap_nodes = [
    for node in var.nodes : node
    if node.bootstrap
  ]

  bootstrap_node = one(local.bootstrap_nodes)
}

resource "talos_machine_secrets" "cluster" {
  talos_version = var.talos_version
}

data "talos_client_configuration" "cluster" {
  cluster_name         = var.cluster_name
  client_configuration = talos_machine_secrets.cluster.client_configuration
  endpoints            = [for node in var.nodes : node.ip]
  nodes                = [for node in var.nodes : node.ip]
}

data "talos_machine_configuration" "role" {
  for_each = toset(["controlplane", "worker"])

  cluster_name       = var.cluster_name
  cluster_endpoint   = var.cluster_endpoint
  machine_type       = each.key
  talos_version      = var.talos_version
  kubernetes_version = var.kubernetes_version
  machine_secrets    = talos_machine_secrets.cluster.machine_secrets

  config_patches = [
    yamlencode({
      machine = {
        install = {
          disk  = var.install_disk
          image = var.talos_installer_image
        }
      }
      cluster = {
        network = {
          cni = {
            name = "none"
          }
        }
        proxy = {
          disabled = true
        }
      }
    })
  ]
}

resource "talos_machine_configuration_apply" "node" {
  for_each = local.nodes

  client_configuration        = talos_machine_secrets.cluster.client_configuration
  machine_configuration_input = data.talos_machine_configuration.role[each.value.role].machine_configuration
  endpoint                    = each.value.ip
  node                        = each.value.ip
}

resource "talos_machine_bootstrap" "cluster" {
  node                 = local.bootstrap_node.ip
  endpoint             = local.bootstrap_node.ip
  client_configuration = talos_machine_secrets.cluster.client_configuration
  depends_on           = [talos_machine_configuration_apply.node]
}

resource "talos_cluster_kubeconfig" "cluster" {
  client_configuration = talos_machine_secrets.cluster.client_configuration
  node                 = local.bootstrap_node.ip
  endpoint             = local.bootstrap_node.ip
  depends_on           = [talos_machine_bootstrap.cluster]
}

resource "helm_release" "argocd" {
  name             = "argocd"
  namespace        = "argocd"
  create_namespace = true
  repository       = "https://argoproj.github.io/argo-helm"
  chart            = "argo-cd"
  version          = var.argocd_chart_version

  values = [yamlencode({
    server = {
      service = {
        type = "ClusterIP"
      }
    }
    controller = {
      replicas = 1
    }
    repoServer = {
      replicas = 1
    }
    applicationSet = {
      replicas = 1
    }
  })]

  depends_on = [talos_cluster_kubeconfig.cluster]
}

resource "kubernetes_secret_v1" "gitea" {
  metadata {
    name      = "gitea-repository"
    namespace = "argocd"
    labels = {
      "argocd.argoproj.io/secret-type" = "repository"
    }
  }

  type = "Opaque"

  data = {
    type     = "git"
    url      = var.gitea_repository_url
    username = var.gitea_username
    password = var.gitea_password
  }

  depends_on = [helm_release.argocd]
}