store bcrypt hash in .env, pass to helm via --set at install time

README.md

@@ -51,18 +51,22 @@ helm version
 cp .env.example .env
 ```
 
-Edit `.env` and set `ARGOCD_ADMIN_PASSWORD` to your desired password. This file is gitignored — never commit it.
-
----
-
-## Phase 3 — Install ArgoCD
-
-Install `httpd-tools` for bcrypt hash generation (one-time):
+Generate a bcrypt hash of your password and paste it into `.env`:
 
 ```bash
 sudo dnf install -y httpd-tools
 ```
 
+```bash
+htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
+```
+
+Set `ARGOCD_ADMIN_PASSWORD_HASH` in `.env` to the output. This file is gitignored — never commit it.
+
+---
+
+## Phase 3 — Install ArgoCD
+
 Add Helm repo:
 
 ```bash
@@ -73,10 +77,14 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD with your password from `.env`:
+Install ArgoCD:
 
 ```bash
-source .env && BCRYPT=$(htpasswd -nbBC 10 "" "$ARGOCD_ADMIN_PASSWORD" | tr -d ':\n' | sed 's/$2y/$2a/') && helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml --set configs.secret.argocdServerAdminPassword="$BCRYPT" --set configs.secret.argocdServerAdminPasswordMtime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+source .env
+```
+
+```bash
+helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml --set configs.secret.argocdServerAdminPassword="$ARGOCD_ADMIN_PASSWORD_HASH" --set configs.secret.argocdServerAdminPasswordMtime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 ```
 
 Wait for ArgoCD to be ready:
@@ -91,7 +99,7 @@ Port-forward to access UI (MetalLB + Envoy not running yet):
 kubectl port-forward svc/argocd-server -n argocd 8080:443
 ```
 
-Open `https://localhost:8080` — login with `admin` and the password from your `.env`.
+Open `https://localhost:8080` — login with `admin` and the password you chose.
 
 ---