From 6dfae38adfb3ccc66b6083c71acbd47a37073346 Mon Sep 17 00:00:00 2001
From: jv <jv@debian>
Date: Wed, 16 Sep 2026 11:54:25 -0500
Subject: [PATCH] Platform: re-keyscan Argo CD GitOps SSH host on every apply

The argocd_private_repo provisioner only ran when its static triggers
(namespace, repo_url, ssh_key_path) changed. When the Gitea SSH host key
rotated (container rebuild / Debian rekey), the trigger set stayed
identical so tofu apply never re-ran the ssh-keyscan, silently leaving
Argo CD with 'knownhosts: key is unknown' and all Applications in
ComparisonError.

Add a timestamp()-based scan_revision trigger so the keyscan +
configmap/secret merge runs on EVERY apply, self-healing the host key
in argocd-ssh-known-hosts-cm. The provisioner is idempotent (reads the
existing configmap, merges the fresh scan, sorts, reapplies), so
re-running is safe.
---
 bootstrap/platform/main.tf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/bootstrap/platform/main.tf b/bootstrap/platform/main.tf
index 610ec27..efc9eb6 100644
--- a/bootstrap/platform/main.tf
+++ b/bootstrap/platform/main.tf
@@ -1301,6 +1301,11 @@ resource "null_resource" "argocd_private_repo" {
     secret_name     = var.argocd.repo_secret_name
     repo_url        = var.gitops_repo_url
     ssh_key_path    = var.gitops_ssh_key_path
+    # Force the keyscan + configmap/secret merge to re-run on EVERY apply.
+    # The GitOps SSH host key can rotate (Gitea container rebuilt, Debian host
+    # rekeyed) and the static triggers above would otherwise never change,
+    # silently leaving Argo CD with `knownhosts: key is unknown`.
+    scan_revision = timestamp()
   }
 
   provisioner "local-exec" {