unkinben
fd82876f5f
Add a data-driven 'user' config kind so Gitea accounts are declared as config/git.unkin.net/user/<name>.yaml, mirroring the existing repository and team kinds. Wire the yaml into a new modules/user submodule that creates a gitea_user (provider go-gitea/gitea 0.7.0, already pinned). The provider's user resource requires a password; generate a per-user random_password so nothing sensitive is hardcoded and only a placeholder lives in state (tokens come later from vault-plugin-secrets-gitea). Provision teabot's implementer and reviewer personality accounts with a conservative posture: not site admins, no org creation, no repo creation, limited profile visibility. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
100 lines
3.9 KiB
Terraform
100 lines
3.9 KiB
Terraform
variable "organisation" {
|
|
description = "Map of organisations to create"
|
|
type = map(object({
|
|
name = string
|
|
description = optional(string, "")
|
|
full_name = optional(string)
|
|
visibility = optional(string, "public")
|
|
website = optional(string, "")
|
|
location = optional(string, "")
|
|
repo_admin_change_team_access = optional(bool, false)
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
variable "repository" {
|
|
description = "Map of repositories to create"
|
|
type = map(object({
|
|
name = string
|
|
organisation = string
|
|
description = optional(string)
|
|
private = optional(bool)
|
|
default_branch = optional(string)
|
|
has_issues = optional(bool)
|
|
has_wiki = optional(bool)
|
|
has_pull_requests = optional(bool)
|
|
has_projects = optional(bool)
|
|
allow_merge_commits = optional(bool)
|
|
allow_rebase = optional(bool)
|
|
allow_rebase_explicit = optional(bool)
|
|
allow_squash_merge = optional(bool)
|
|
archived = optional(bool)
|
|
repo_template = optional(bool)
|
|
website = optional(string)
|
|
autodetect_manual_merge = optional(bool)
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
variable "branch_protection" {
|
|
description = "Map of branch protection rules to create"
|
|
type = map(object({
|
|
repository = string
|
|
organisation = string
|
|
rule_name = string
|
|
enable_push = optional(bool, false)
|
|
push_whitelist_users = optional(list(string), [])
|
|
push_whitelist_teams = optional(list(string), [])
|
|
push_whitelist_deploy_keys = optional(bool, false)
|
|
merge_whitelist_users = optional(list(string), [])
|
|
merge_whitelist_teams = optional(list(string), [])
|
|
required_approvals = optional(number, 0)
|
|
approval_whitelist_users = optional(list(string), [])
|
|
approval_whitelist_teams = optional(list(string), [])
|
|
status_check_contexts = optional(list(string), [])
|
|
block_on_rejected_reviews = optional(bool, false)
|
|
block_on_official_review_requests = optional(bool, false)
|
|
block_on_outdated_branch = optional(bool, false)
|
|
dismiss_stale_approvals = optional(bool, false)
|
|
require_signed_commits = optional(bool, false)
|
|
protected_file_patterns = optional(string, "")
|
|
unprotected_file_patterns = optional(string, "")
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
|
|
variable "user" {
|
|
description = "Map of Gitea user accounts to create"
|
|
type = map(object({
|
|
username = string
|
|
email = string
|
|
login_name = optional(string)
|
|
full_name = optional(string, "")
|
|
description = optional(string, "")
|
|
visibility = optional(string, "limited")
|
|
admin = optional(bool, false)
|
|
restricted = optional(bool, false)
|
|
active = optional(bool, true)
|
|
allow_create_organization = optional(bool, false)
|
|
max_repo_creation = optional(number, 0)
|
|
must_change_password = optional(bool, false)
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
variable "team" {
|
|
description = "Map of teams to create"
|
|
type = map(object({
|
|
name = string
|
|
organisation = string
|
|
description = optional(string, "")
|
|
permission = optional(string, "read")
|
|
include_all_repositories = optional(bool, false)
|
|
can_create_repos = optional(bool, false)
|
|
repositories = optional(list(string), [])
|
|
members = optional(list(string), [])
|
|
}))
|
|
default = {}
|
|
}
|