From ca70f906f18d616e27ef44f3badbe84d1455462d Mon Sep 17 00:00:00 2001
From: Bharat Kathi <bharat1031@gmail.com>
Date: Fri, 10 Jul 2026 23:21:22 -0700
Subject: [PATCH] chore: purge sentinel-v5 references

---
 infra/environments/prod/foundry.tf |  4 ++--
 infra/environments/prod/main.tf    | 12 ++----------
 infra/modules/argocd/variables.tf  |  2 +-
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/infra/environments/prod/foundry.tf b/infra/environments/prod/foundry.tf
index 32cf3af..7c461b8 100644
--- a/infra/environments/prod/foundry.tf
+++ b/infra/environments/prod/foundry.tf
@@ -44,8 +44,8 @@
 #         record, writes CNAME → <tunnel-id>.cfargotunnel.com within
 #         its --interval (1m default).
 #      d. Traffic starts landing on foundry within CF TTL.
-#   5. Bake. Add each remaining hostname (sentinel-v5 / mapache / vault)
-#      in a follow-up PR — copy gr-prod/manifests/<svc>/ into
+#   5. Bake. Add each remaining hostname (mapache / vault) in a
+#      follow-up PR — copy gr-prod/manifests/<svc>/ into
 #      gr-foundry/manifests/<svc>/ with two file changes (ingress.yaml →
 #      Traefik + external-dns annotation, postgres.yaml → public
 #      hostname). No terraform edit needed.
diff --git a/infra/environments/prod/main.tf b/infra/environments/prod/main.tf
index 23b3763..dcf3f18 100644
--- a/infra/environments/prod/main.tf
+++ b/infra/environments/prod/main.tf
@@ -210,7 +210,8 @@ resource "cloudflare_dns_record" "gr_clickhouse" {
 # Cloudflare allows one entrypoint ruleset per (zone, phase). The
 # argocd rule was originally created via the dashboard, which Cloudflare
 # stores as an http_config_settings ruleset under the hood. We import
-# that existing ruleset and add the sentinel-v5 rule alongside it.
+# that existing ruleset and manage the remaining per-hostname rules
+# alongside it.
 resource "cloudflare_ruleset" "ssl_overrides" {
   zone_id = data.cloudflare_zone.gauchoracing.id
   name    = "Per-hostname SSL overrides"
@@ -227,15 +228,6 @@ resource "cloudflare_ruleset" "ssl_overrides" {
         ssl = "strict"
       }
     },
-    {
-      description = "sentinel-v5-strict-mode"
-      expression  = "(http.host eq \"sentinel-v5.gauchoracing.com\")"
-      action      = "set_config"
-      enabled     = true
-      action_parameters = {
-        ssl = "strict"
-      }
-    },
     {
       description = "mapache-strict-mode"
       expression  = "(http.host eq \"mapache.gauchoracing.com\")"
diff --git a/infra/modules/argocd/variables.tf b/infra/modules/argocd/variables.tf
index 1c14b03..fc31c65 100644
--- a/infra/modules/argocd/variables.tf
+++ b/infra/modules/argocd/variables.tf
@@ -19,7 +19,7 @@ variable "domain" {
 variable "oidc_issuer" {
   description = "OIDC issuer for SSO. Must byte-match Sentinel's ISSUER and the iss claim in its tokens."
   type        = string
-  default     = "https://sentinel-v5.gauchoracing.com"
+  default     = "https://sso.gauchoracing.com"
 }
 
 variable "oidc_client_id" {