unkinben
646fa0f840
Add a Terraform provider that manages the Gitea token secrets engine (vault-plugin-secrets-gitea) on Vault/OpenBao, so terraform-vault can drive the engine's mount, config, and roles declaratively. - add the provider (source git.unkin.net/unkin/giteavaultsecret, prefix gitea_) - add gitea_secret_backend (mount + config with seeded admin credentials) - add gitea_secret_backend_role (username, scopes list, ttls, token_name_prefix) - add the Vault API client plumbing, conversions, and unit tests - add examples, a real terraform+Vault+mock-Gitea e2e, and Woodpecker pipelines releasing the provider zip to the artifactapi terraform registry Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
33 lines
731 B
Terraform
33 lines
731 B
Terraform
terraform {
|
|
required_providers {
|
|
gitea = {
|
|
source = "git.unkin.net/unkin/giteavaultsecret"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "gitea" {
|
|
address = "http://127.0.0.1:8200"
|
|
token = "root"
|
|
}
|
|
|
|
resource "gitea_secret_backend" "gitea" {
|
|
path = "gitea"
|
|
description = "Gitea token engine (e2e)"
|
|
# Reachable from inside the vault container, where the plugin runs.
|
|
gitea_url = "http://gitea:3000"
|
|
tls_skip_verify = true
|
|
|
|
admin_username = "bot-admin"
|
|
admin_password = "seed-password"
|
|
}
|
|
|
|
resource "gitea_secret_backend_role" "teabot" {
|
|
backend = gitea_secret_backend.gitea.path
|
|
name = "teabot"
|
|
username = "teabot"
|
|
scopes = ["read:repository", "write:issue"]
|
|
ttl = 3600
|
|
max_ttl = 86400
|
|
}
|