unkinben
bd7bef9f99
Why: the vault-plugin-secrets-gitea engine needs a purpose-built Gitea site-admin credential to mint and delete per-user tokens. Provision that account and its Vault seed here so the credential is generated once and never exposed. Ben asked that the password be written to Vault exactly once and never updated afterwards. Change: - Add config/git.unkin.net/user/gitea-vault-admin.yaml: a local site-admin bot (admin: true, limited visibility, no org/repo creation). - Extend the user module with an optional vault_seed_path/vault_seed_mount: when set, write the account's generated password to Vault KV as admin_username and admin_password via vault_kv_secret_v2, with lifecycle ignore_changes on data_json so the write is create-only and never churns (random_password already never regenerates). This keeps the seed stable and prevents a re-apply from overwriting a password later rotated out-of-band by rotate-root. - Add the hashicorp/vault provider (module plus root generate block); it reads VAULT_ADDR and VAULT_TOKEN already exported by the Makefile k8s login. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
88 lines
2.2 KiB
Terraform
88 lines
2.2 KiB
Terraform
variable "username" {
|
|
description = "Username of the Gitea account (immutable; changing it recreates the user)"
|
|
type = string
|
|
}
|
|
|
|
variable "login_name" {
|
|
description = "Login name, may differ from username. Defaults to the username."
|
|
type = string
|
|
default = null
|
|
}
|
|
|
|
variable "email" {
|
|
description = "E-Mail address of the user"
|
|
type = string
|
|
}
|
|
|
|
variable "full_name" {
|
|
description = "Display / full name of the user"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "description" {
|
|
description = "Profile description of the user"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "visibility" {
|
|
description = "Profile visibility: public, limited or private"
|
|
type = string
|
|
default = "limited"
|
|
}
|
|
|
|
variable "admin" {
|
|
description = "Whether the user is a site administrator"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "restricted" {
|
|
description = "Restricted users can only access repositories/orgs they are explicitly added to"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "active" {
|
|
description = "Whether the account is active"
|
|
type = bool
|
|
default = true
|
|
}
|
|
|
|
variable "allow_create_organization" {
|
|
description = "Whether the user may create organisations"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "max_repo_creation" {
|
|
description = "Maximum number of repositories the user may create (0 disallows creation)"
|
|
type = number
|
|
default = 0
|
|
}
|
|
|
|
variable "must_change_password" {
|
|
description = "Force a password change on first login"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "vault_seed_path" {
|
|
description = <<-EOT
|
|
Optional. When set, the account's generated password is seeded ONCE to Vault
|
|
KV at this secret name (under vault_seed_mount) as admin_username +
|
|
admin_password, for the vault-plugin-secrets-gitea engine to consume at
|
|
creation time. The write is create-only; subsequent changes are ignored so
|
|
the seed never churns (and never overwrites a rotated password).
|
|
EOT
|
|
type = string
|
|
default = null
|
|
}
|
|
|
|
variable "vault_seed_mount" {
|
|
description = "KV v2 mount holding the seeded credential (used only when vault_seed_path is set)"
|
|
type = string
|
|
default = "kv"
|
|
}
|