use self signed cert for internal domain arcodange.lab

ansible/arcodange/factory/playbooks/03_cicd.yml

@@ -36,8 +36,6 @@
                 - /var/run/docker.sock:/var/run/docker.sock
                 - /etc/timezone:/etc/timezone:ro
                 - /etc/localtime:/etc/localtime:ro
-              extra_hosts:
-                gitea.arcodange.duckdns.org: '{{ lookup("dig", "gitea.arcodange.duckdns.org") }}'
               configs:
                 - config.yaml
           configs:
@@ -217,6 +215,15 @@
     - set_fact:
         k3s_master_node: "{{ get_k3s_master_node.stdout }}"
         k3s_internal_server_url: "{{ get_k3s_internal_server_url.stdout }}"
+    - name: Read Step CA root certificate from k3s master
+      become: true
+      delegate_to: "{{ k3s_master_node }}"
+      slurp:
+        src: /home/step/.step/certs/root_ca.crt
+      register: step_ca_root_cert
+    - name: Decode Step CA root certificate
+      set_fact:
+        step_ca_root_cert_pem: "{{ step_ca_root_cert.content | b64decode }}"
     - name: Install Argo CD
       become: true
       delegate_to: "{{ k3s_master_node }}"
@@ -226,7 +233,7 @@
           password: "{{ argocd_token }}"
         argocd_helm_values: # https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml
           global:
-            domain: argocd.arcodange.duckdns.org
+            domain: argocd.arcodange.lab
           configs:
             cm:
               kustomize.buildOptions: "--enable-helm"
@@ -242,6 +249,15 @@
           metadata:
             name: argocd
           ---
+          apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: argocd-tls-certs-cm
+            namespace: argocd
+          data:
+            gitea.arcodange.lab: |
+              {{ step_ca_root_cert_pem | indent(4) }}
+          ---
           apiVersion: helm.cattle.io/v1
           kind: HelmChart
           metadata:
@@ -264,12 +280,12 @@
               traefik.ingress.kubernetes.io/router.entrypoints: websecure
               traefik.ingress.kubernetes.io/router.tls: "true"
               traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
-              traefik.ingress.kubernetes.io/router.tls.domains.0.main: arcodange.duckdns.org
-              traefik.ingress.kubernetes.io/router.tls.domains.0.sans: argocd.arcodange.duckdns.org
+              traefik.ingress.kubernetes.io/router.tls.domains.0.main: arcodange.lab
+              traefik.ingress.kubernetes.io/router.tls.domains.0.sans: argocd.arcodange.lab
               traefik.ingress.kubernetes.io/router.middlewares: localIp@file
           spec:
             rules:
-            - host: argocd.arcodange.duckdns.org
+            - host: argocd.arcodange.lab
               http:
                 paths:
                 - path: /
@@ -289,7 +305,7 @@
               argocd.argoproj.io/secret-type: repository
           stringData:
             type: git
-            url: https://gitea.arcodange.duckdns.org/arcodange-org/factory
+            url: https://gitea.arcodange.lab/arcodange-org/factory
           ---
           apiVersion: v1
           kind: Secret
@@ -300,7 +316,7 @@
               argocd.argoproj.io/secret-type: repo-creds
           stringData:
             type: git
-            url: https://gitea.arcodange.duckdns.org/arcodange-org
+            url: https://gitea.arcodange.lab/arcodange-org
             password: {{ gitea_credentials.password }}
             username: {{ gitea_credentials.username }}
           ---
@@ -312,7 +328,7 @@
           spec:
             project: default
             source:
-              repoURL: https://gitea.arcodange.duckdns.org/arcodange-org/factory
+              repoURL: https://gitea.arcodange.lab/arcodange-org/factory
               targetRevision: HEAD
               path: argocd
             destination: