initial implementation: terraform-provider-encapi

Terraform/OpenTofu provider for encapi (the Puppet ENC replacing Cobbler).
- resources: encapi_role (jsonencode default_params), encapi_status, encapi_node
- data sources: encapi_node, encapi_role
- client with bearer-token auth; unit tests; examples
- Makefile (package->zip), Woodpecker CI publishing to the artifactapi
  terraform-unkin registry on tag

examples/data-sources/encapi_node/main.tf

@@ -0,0 +1,11 @@
+data "encapi_node" "web0" {
+  certname = "ausyd1nxvm2000.main.unkin.net"
+}
+
+output "web0_role" {
+  value = data.encapi_node.web0.role
+}
+
+output "web0_environment" {
+  value = data.encapi_node.web0.environment
+}

examples/main.tf

@@ -0,0 +1,82 @@
+terraform {
+  required_providers {
+    encapi = {
+      source  = "git.unkin.net/unkin/encapi"
+      version = "0.0.1"
+    }
+  }
+}
+
+provider "encapi" {
+  endpoint = "https://encapi.k8s.syd1.au.unkin.net"
+  # token defaults to the ENCAPI_WRITE_TOKEN environment variable
+}
+
+# ---------------------------------------------------------------------------
+# Statuses (Puppet environments / Cobbler "status")
+# ---------------------------------------------------------------------------
+
+resource "encapi_status" "testing" {
+  name        = "testing"
+  description = "Implicit environment; dropped from ENC output so agents use their default."
+}
+
+resource "encapi_status" "production" {
+  name = "production"
+}
+
+resource "encapi_status" "development" {
+  name = "development"
+}
+
+# ---------------------------------------------------------------------------
+# Roles, with inheritable default params (use jsonencode to keep value types)
+# ---------------------------------------------------------------------------
+
+resource "encapi_role" "vault" {
+  name        = "roles::infra::storage::vault"
+  description = "HashiCorp Vault cluster member"
+}
+
+resource "encapi_role" "minio" {
+  name        = "roles::infra::storage::minio"
+  description = "MinIO object storage node"
+
+  default_params = jsonencode({
+    minio_pool = "pool1"
+    replicas   = 4
+  })
+}
+
+# ---------------------------------------------------------------------------
+# Node assignments
+# ---------------------------------------------------------------------------
+
+resource "encapi_node" "vault0" {
+  certname    = "ausyd1nxvm2000.main.unkin.net"
+  role        = encapi_role.vault.name
+  environment = encapi_status.testing.name
+}
+
+resource "encapi_node" "minio0" {
+  certname    = "ausyd1nxvm2100.main.unkin.net"
+  role        = encapi_role.minio.name
+  environment = encapi_status.production.name
+
+  # per-node override of the role default
+  params = jsonencode({
+    minio_pool = "pool2"
+  })
+}
+
+# ---------------------------------------------------------------------------
+# Data sources
+# ---------------------------------------------------------------------------
+
+data "encapi_node" "vault0" {
+  certname = encapi_node.vault0.certname
+}
+
+output "vault0_role" {
+  value = data.encapi_node.vault0.role
+}

examples/resources/encapi_node/main.tf

@@ -0,0 +1,10 @@
+resource "encapi_node" "example" {
+  certname    = "ausyd1nxvm2000.main.unkin.net"
+  role        = "roles::infra::storage::vault"
+  environment = "testing"
+
+  # Optional per-node overrides (win over the role's default_params).
+  params = jsonencode({
+    vault_role = "leader"
+  })
+}

examples/resources/encapi_role/main.tf

@@ -0,0 +1,12 @@
+resource "encapi_role" "minio" {
+  name        = "roles::infra::storage::minio"
+  description = "MinIO object storage node"
+
+  # Inheritable defaults, merged into every node with this role.
+  # Use jsonencode so numbers/bools keep their type in the ENC output.
+  default_params = jsonencode({
+    minio_pool = "pool1"
+    replicas   = 4
+    tls        = true
+  })
+}

examples/resources/encapi_status/main.tf

@@ -0,0 +1,14 @@
+# Statuses map to Puppet environments. Define as many as your estate uses;
+# a node can only be pinned to one that exists.
+resource "encapi_status" "testing" {
+  name = "testing"
+}
+
+resource "encapi_status" "production" {
+  name        = "production"
+  description = "Production environment"
+}
+
+resource "encapi_status" "development" {
+  name = "development"
+}