feat: initial terraform-git project

Manage Gitea resources via Terraform/Terragrunt with YAML-driven config.

Resources managed:
- Organisation (unkin)
- 28 repositories with settings
- 6 teams with members
- 13 branch protection rules
- 9 Woodpecker CI repo activations
- Deploy key module (ready, no keys yet)

Config structure: config/<service>/<org>/<type>/<object>.yaml
Consul backend for state, Vault for auth tokens.

modules/gitea_instance/modules/branch_protection/main.tf

@@ -0,0 +1,27 @@
+resource "gitea_repository_branch_protection" "this" {
+  username  = var.organisation
+  name      = var.repository
+  rule_name = var.rule_name
+
+  enable_push                = var.enable_push
+  push_whitelist_users       = var.push_whitelist_users
+  push_whitelist_teams       = var.push_whitelist_teams
+  push_whitelist_deploy_keys = var.push_whitelist_deploy_keys
+
+  merge_whitelist_users = var.merge_whitelist_users
+  merge_whitelist_teams = var.merge_whitelist_teams
+
+  required_approvals       = var.required_approvals
+  approval_whitelist_users = var.approval_whitelist_users
+  approval_whitelist_teams = var.approval_whitelist_teams
+
+  status_check_patterns = var.status_check_contexts
+
+  block_merge_on_rejected_reviews         = var.block_on_rejected_reviews
+  block_merge_on_official_review_requests = var.block_on_official_review_requests
+  block_merge_on_outdated_branch          = var.block_on_outdated_branch
+  dismiss_stale_approvals                 = var.dismiss_stale_approvals
+  require_signed_commits                  = var.require_signed_commits
+  protected_file_patterns                 = var.protected_file_patterns
+  unprotected_file_patterns               = var.unprotected_file_patterns
+}

modules/gitea_instance/modules/branch_protection/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    gitea = {
+      source  = "go-gitea/gitea"
+      version = "0.7.0"
+    }
+  }
+}

modules/gitea_instance/modules/branch_protection/variables.tf

@@ -0,0 +1,96 @@
+variable "repository" {
+  type = string
+}
+
+variable "organisation" {
+  type = string
+}
+
+variable "rule_name" {
+  type = string
+}
+
+variable "enable_push" {
+  type    = bool
+  default = false
+}
+
+variable "push_whitelist_users" {
+  type    = list(string)
+  default = []
+}
+
+variable "push_whitelist_teams" {
+  type    = list(string)
+  default = []
+}
+
+variable "push_whitelist_deploy_keys" {
+  type    = bool
+  default = false
+}
+
+variable "merge_whitelist_users" {
+  type    = list(string)
+  default = []
+}
+
+variable "merge_whitelist_teams" {
+  type    = list(string)
+  default = []
+}
+
+variable "required_approvals" {
+  type    = number
+  default = 0
+}
+
+variable "approval_whitelist_users" {
+  type    = list(string)
+  default = []
+}
+
+variable "approval_whitelist_teams" {
+  type    = list(string)
+  default = []
+}
+
+variable "status_check_contexts" {
+  type    = list(string)
+  default = []
+}
+
+variable "block_on_rejected_reviews" {
+  type    = bool
+  default = false
+}
+
+variable "block_on_official_review_requests" {
+  type    = bool
+  default = false
+}
+
+variable "block_on_outdated_branch" {
+  type    = bool
+  default = false
+}
+
+variable "dismiss_stale_approvals" {
+  type    = bool
+  default = false
+}
+
+variable "require_signed_commits" {
+  type    = bool
+  default = false
+}
+
+variable "protected_file_patterns" {
+  type    = string
+  default = ""
+}
+
+variable "unprotected_file_patterns" {
+  type    = string
+  default = ""
+}

modules/gitea_instance/modules/deploy_key/main.tf

@@ -0,0 +1,6 @@
+resource "gitea_repository_key" "this" {
+  repository = var.repository_id
+  title      = var.title
+  key        = var.key
+  read_only  = var.read_only
+}

modules/gitea_instance/modules/deploy_key/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    gitea = {
+      source  = "go-gitea/gitea"
+      version = "0.7.0"
+    }
+  }
+}

modules/gitea_instance/modules/deploy_key/variables.tf

@@ -0,0 +1,16 @@
+variable "repository_id" {
+  type = number
+}
+
+variable "title" {
+  type = string
+}
+
+variable "key" {
+  type = string
+}
+
+variable "read_only" {
+  type    = bool
+  default = true
+}

modules/gitea_instance/modules/organisation/main.tf

@@ -0,0 +1,9 @@
+resource "gitea_org" "this" {
+  name                          = var.name
+  description                   = var.description
+  full_name                     = var.full_name
+  visibility                    = var.visibility
+  website                       = var.website
+  location                      = var.location
+  repo_admin_change_team_access = var.repo_admin_change_team_access
+}

modules/gitea_instance/modules/organisation/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    gitea = {
+      source  = "go-gitea/gitea"
+      version = "0.7.0"
+    }
+  }
+}

modules/gitea_instance/modules/organisation/variables.tf

@@ -0,0 +1,33 @@
+variable "name" {
+  type = string
+}
+
+variable "description" {
+  type    = string
+  default = ""
+}
+
+variable "full_name" {
+  type    = string
+  default = null
+}
+
+variable "visibility" {
+  type    = string
+  default = "public"
+}
+
+variable "website" {
+  type    = string
+  default = ""
+}
+
+variable "location" {
+  type    = string
+  default = ""
+}
+
+variable "repo_admin_change_team_access" {
+  type    = bool
+  default = false
+}

modules/gitea_instance/modules/repository/main.tf

@@ -0,0 +1,20 @@
+resource "gitea_repository" "this" {
+  username                = var.organisation
+  name                    = var.name
+  description             = var.description
+  private                 = var.private
+  default_branch          = var.default_branch
+  has_issues              = var.has_issues
+  has_wiki                = var.has_wiki
+  has_pull_requests       = var.has_pull_requests
+  has_projects            = var.has_projects
+  allow_merge_commits     = var.allow_merge_commits
+  allow_rebase            = var.allow_rebase
+  allow_rebase_explicit   = var.allow_rebase_explicit
+  allow_squash_merge      = var.allow_squash_merge
+  archived                = var.archived
+  repo_template           = var.repo_template
+  website                 = var.website
+  autodetect_manual_merge = var.autodetect_manual_merge
+  archive_on_destroy      = true
+}

modules/gitea_instance/modules/repository/outputs.tf

@@ -0,0 +1,3 @@
+output "id" {
+  value = gitea_repository.this.id
+}

modules/gitea_instance/modules/repository/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    gitea = {
+      source  = "go-gitea/gitea"
+      version = "0.7.0"
+    }
+  }
+}

modules/gitea_instance/modules/repository/variables.tf

@@ -0,0 +1,82 @@
+variable "name" {
+  type = string
+}
+
+variable "organisation" {
+  type = string
+}
+
+variable "description" {
+  type    = string
+  default = null
+}
+
+variable "private" {
+  type    = bool
+  default = null
+}
+
+variable "default_branch" {
+  type    = string
+  default = null
+}
+
+variable "has_issues" {
+  type    = bool
+  default = true
+}
+
+variable "has_wiki" {
+  type    = bool
+  default = false
+}
+
+variable "has_pull_requests" {
+  type    = bool
+  default = true
+}
+
+variable "has_projects" {
+  type    = bool
+  default = false
+}
+
+variable "allow_merge_commits" {
+  type    = bool
+  default = false
+}
+
+variable "allow_rebase" {
+  type    = bool
+  default = false
+}
+
+variable "allow_rebase_explicit" {
+  type    = bool
+  default = false
+}
+
+variable "allow_squash_merge" {
+  type    = bool
+  default = true
+}
+
+variable "archived" {
+  type    = bool
+  default = null
+}
+
+variable "repo_template" {
+  type    = bool
+  default = null
+}
+
+variable "website" {
+  type    = string
+  default = null
+}
+
+variable "autodetect_manual_merge" {
+  type    = bool
+  default = null
+}

modules/gitea_instance/modules/team/main.tf

@@ -0,0 +1,14 @@
+resource "gitea_team" "this" {
+  name                     = var.name
+  organisation             = var.organisation
+  description              = var.description
+  permission               = var.permission
+  include_all_repositories = var.include_all_repositories
+  can_create_repos         = var.can_create_repos
+  repositories             = var.repositories
+}
+
+resource "gitea_team_members" "this" {
+  team_id = gitea_team.this.id
+  members = toset(var.members)
+}

modules/gitea_instance/modules/team/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    gitea = {
+      source  = "go-gitea/gitea"
+      version = "0.7.0"
+    }
+  }
+}

modules/gitea_instance/modules/team/variables.tf

@@ -0,0 +1,37 @@
+variable "name" {
+  type = string
+}
+
+variable "organisation" {
+  type = string
+}
+
+variable "description" {
+  type    = string
+  default = ""
+}
+
+variable "permission" {
+  type    = string
+  default = "read"
+}
+
+variable "include_all_repositories" {
+  type    = bool
+  default = false
+}
+
+variable "can_create_repos" {
+  type    = bool
+  default = false
+}
+
+variable "repositories" {
+  type    = list(string)
+  default = []
+}
+
+variable "members" {
+  type    = list(string)
+  default = []
+}

modules/gitea_instance/modules/woodpecker_repository/main.tf

@@ -0,0 +1,4 @@
+resource "woodpecker_repository" "this" {
+  full_name  = var.full_name
+  visibility = var.visibility
+}

modules/gitea_instance/modules/woodpecker_repository/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    woodpecker = {
+      source  = "Kichiyaki/woodpecker"
+      version = "0.5.0"
+    }
+  }
+}

modules/gitea_instance/modules/woodpecker_repository/variables.tf

@@ -0,0 +1,8 @@
+variable "full_name" {
+  type = string
+}
+
+variable "visibility" {
+  type    = string
+  default = "internal"
+}