unkinben
bd7bef9f99
Why: the vault-plugin-secrets-gitea engine needs a purpose-built Gitea site-admin credential to mint and delete per-user tokens. Provision that account and its Vault seed here so the credential is generated once and never exposed. Ben asked that the password be written to Vault exactly once and never updated afterwards. Change: - Add config/git.unkin.net/user/gitea-vault-admin.yaml: a local site-admin bot (admin: true, limited visibility, no org/repo creation). - Extend the user module with an optional vault_seed_path/vault_seed_mount: when set, write the account's generated password to Vault KV as admin_username and admin_password via vault_kv_secret_v2, with lifecycle ignore_changes on data_json so the write is create-only and never churns (random_password already never regenerates). This keeps the seed stable and prevents a re-apply from overwriting a password later rotated out-of-band by rotate-root. - Add the hashicorp/vault provider (module plus root generate block); it reads VAULT_ADDR and VAULT_TOKEN already exported by the Makefile k8s login. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
118 lines
4.5 KiB
Terraform
118 lines
4.5 KiB
Terraform
module "organisation" {
|
|
source = "./modules/organisation"
|
|
|
|
for_each = var.organisation
|
|
|
|
name = each.value.name
|
|
description = each.value.description
|
|
full_name = each.value.full_name
|
|
visibility = each.value.visibility
|
|
website = each.value.website
|
|
location = each.value.location
|
|
repo_admin_change_team_access = each.value.repo_admin_change_team_access
|
|
}
|
|
|
|
module "repository" {
|
|
source = "./modules/repository"
|
|
|
|
for_each = var.repository
|
|
|
|
name = each.value.name
|
|
organisation = each.value.organisation
|
|
description = each.value.description
|
|
private = each.value.private
|
|
default_branch = each.value.default_branch
|
|
has_issues = each.value.has_issues
|
|
has_wiki = each.value.has_wiki
|
|
has_pull_requests = each.value.has_pull_requests
|
|
has_projects = each.value.has_projects
|
|
allow_merge_commits = each.value.allow_merge_commits
|
|
allow_rebase = each.value.allow_rebase
|
|
allow_rebase_explicit = each.value.allow_rebase_explicit
|
|
allow_squash_merge = each.value.allow_squash_merge
|
|
archived = each.value.archived
|
|
repo_template = each.value.repo_template
|
|
website = each.value.website
|
|
autodetect_manual_merge = each.value.autodetect_manual_merge
|
|
|
|
depends_on = [module.organisation]
|
|
}
|
|
|
|
module "user" {
|
|
source = "./modules/user"
|
|
|
|
for_each = var.user
|
|
|
|
username = each.value.username
|
|
email = each.value.email
|
|
login_name = each.value.login_name
|
|
full_name = each.value.full_name
|
|
description = each.value.description
|
|
visibility = each.value.visibility
|
|
admin = each.value.admin
|
|
restricted = each.value.restricted
|
|
active = each.value.active
|
|
allow_create_organization = each.value.allow_create_organization
|
|
max_repo_creation = each.value.max_repo_creation
|
|
must_change_password = each.value.must_change_password
|
|
vault_seed_path = each.value.vault_seed_path
|
|
vault_seed_mount = each.value.vault_seed_mount
|
|
}
|
|
|
|
module "team" {
|
|
source = "./modules/team"
|
|
|
|
for_each = var.team
|
|
|
|
name = each.value.name
|
|
organisation = each.value.organisation
|
|
description = each.value.description
|
|
permission = each.value.permission
|
|
include_all_repositories = each.value.include_all_repositories
|
|
can_create_repos = each.value.can_create_repos
|
|
repositories = each.value.repositories
|
|
members = each.value.members
|
|
|
|
depends_on = [module.organisation, module.repository]
|
|
}
|
|
|
|
removed {
|
|
from = module.woodpecker_repository
|
|
|
|
lifecycle {
|
|
destroy = false
|
|
}
|
|
}
|
|
|
|
module "branch_protection" {
|
|
source = "./modules/branch_protection"
|
|
|
|
for_each = var.branch_protection
|
|
|
|
repository = each.value.repository
|
|
organisation = each.value.organisation
|
|
rule_name = each.value.rule_name
|
|
enable_push = each.value.enable_push
|
|
push_whitelist_users = each.value.push_whitelist_users
|
|
push_whitelist_teams = each.value.push_whitelist_teams
|
|
push_whitelist_deploy_keys = each.value.push_whitelist_deploy_keys
|
|
merge_whitelist_users = each.value.merge_whitelist_users
|
|
merge_whitelist_teams = each.value.merge_whitelist_teams
|
|
required_approvals = each.value.required_approvals
|
|
approval_whitelist_users = each.value.approval_whitelist_users
|
|
approval_whitelist_teams = each.value.approval_whitelist_teams
|
|
status_check_contexts = each.value.status_check_contexts
|
|
block_on_rejected_reviews = each.value.block_on_rejected_reviews
|
|
block_on_official_review_requests = each.value.block_on_official_review_requests
|
|
block_on_outdated_branch = each.value.block_on_outdated_branch
|
|
dismiss_stale_approvals = each.value.dismiss_stale_approvals
|
|
require_signed_commits = each.value.require_signed_commits
|
|
protected_file_patterns = each.value.protected_file_patterns
|
|
unprotected_file_patterns = each.value.unprotected_file_patterns
|
|
|
|
depends_on = [module.repository, module.team]
|
|
}
|
|
|
|
# TODO: enable when deploy keys are needed
|
|
# module "deploy_key" { ... }
|