unkin-agent
0d2823293e
Engine plugin v0.2.0 added a `methods` field to roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it. - Add an optional `methods` set attribute to arrstack_secret_backend_role, validated at plan time against GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS. - Always write `methods`, since the engine only clears a scope when the key is present; an unrestricted role reads back as null rather than an empty set so an omitted config value does not drift. - Document the attribute in the README and examples, and cover the write mapping, read-back, and validation in tests.
52 lines
1.3 KiB
Terraform
52 lines
1.3 KiB
Terraform
terraform {
|
|
required_providers {
|
|
arrstack = {
|
|
source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
|
|
version = "0.1.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "arrstack" {
|
|
# address defaults to $VAULT_ADDR, token to $VAULT_TOKEN
|
|
}
|
|
|
|
variable "arrproxy_admin_token" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
resource "arrstack_secret_backend" "arrstack" {
|
|
path = "arrstack"
|
|
base_url = "https://arrstack.unkin.net"
|
|
admin_token = var.arrproxy_admin_token
|
|
}
|
|
|
|
# Role that mints an arrproxy API key scoped to all three arr apps.
|
|
resource "arrstack_secret_backend_role" "all" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "all"
|
|
apps = ["sonarr", "radarr", "prowlarr"]
|
|
ttl = 60
|
|
max_ttl = 86400
|
|
}
|
|
|
|
# Role scoped to Prowlarr only.
|
|
resource "arrstack_secret_backend_role" "prowlarr" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "prowlarr"
|
|
apps = ["prowlarr"]
|
|
ttl = 60
|
|
max_ttl = 86400
|
|
}
|
|
|
|
# Role scoped to read-only traffic across all three apps.
|
|
resource "arrstack_secret_backend_role" "readonly" {
|
|
backend = arrstack_secret_backend.arrstack.path
|
|
name = "readonly"
|
|
apps = ["sonarr", "radarr", "prowlarr"]
|
|
methods = ["GET", "HEAD"]
|
|
ttl = 60
|
|
max_ttl = 86400
|
|
}
|