unkin-agent
ff2dff7af2
ci/woodpecker/tag/release Pipeline was successful
## Why Engine plugin v0.2.0 added a `methods` field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it, so those roles could not be managed from `terraform-vault`. ## How - Adds an optional `methods` set attribute to `arrstack_secret_backend_role`, validated at plan time against `GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS` (upper case only, since the engine stores them upper-cased and a lower-case value would drift on every plan). - Always writes `methods`: the engine only clears an existing scope when the key is present, so an omitted key would leave a stale scope behind. - Reads an unrestricted role back as null rather than an empty set, so a config that omits `methods` shows no drift; a scope cleared out of band still surfaces as a diff. - Documents the attribute in the README and both example configs. - Tests cover the write mapping (null and populated), the read-back cases (absent/empty/null/cleared), and the plan-time validator. Dependency: engine plugin >= 0.2.0. Reviewed-on: #3 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
52 lines
1.3 KiB
Terraform
52 lines
1.3 KiB
Terraform
terraform {
|
|
required_providers {
|
|
arrstack = {
|
|
source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
|
|
version = "0.1.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "arrstack" {
|
|
# address defaults to $VAULT_ADDR, token to $VAULT_TOKEN
|
|
}
|
|
|
|
variable "arrproxy_admin_token" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
resource "arrstack_secret_backend" "arrstack" {
|
|
path = "arrstack"
|
|
base_url = "https://arrstack.unkin.net"
|
|
admin_token = var.arrproxy_admin_token
|
|
}
|
|
|
|
# Role that mints an arrproxy API key scoped to all three arr apps.
|
|
resource "arrstack_secret_backend_role" "all" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "all"
|
|
apps = ["sonarr", "radarr", "prowlarr"]
|
|
ttl = 60
|
|
max_ttl = 86400
|
|
}
|
|
|
|
# Role scoped to Prowlarr only.
|
|
resource "arrstack_secret_backend_role" "prowlarr" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "prowlarr"
|
|
apps = ["prowlarr"]
|
|
ttl = 60
|
|
max_ttl = 86400
|
|
}
|
|
|
|
# Role scoped to read-only traffic across all three apps.
|
|
resource "arrstack_secret_backend_role" "readonly" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "readonly"
|
|
apps = ["sonarr", "radarr", "prowlarr"]
|
|
methods = ["GET", "HEAD"]
|
|
ttl = 60
|
|
max_ttl = 86400
|
|
}
|