From 528e081bf12ac01cdca38ebc6740049d112c96fe Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Wed, 19 Aug 2026 22:48:35 +1000
Subject: [PATCH] vault: scope down to only removing the ghp backend + role
 config YAMLs

Restore the ghp wiring (module instantiations, variables, config.hcl parsing
blocks, and terragrunt inputs) exactly as on master, and remove ONLY the two
ghp config YAMLs. With no yaml files, the for_each maps are empty, so zero ghp
backend/role instances are created and the unseeded ghp/config KV is never read
- the master apply passes while the wiring stays in place for the later re-add.
---
 config/config.hcl                   | 13 ++++++++++
 environments/au/syd1/terragrunt.hcl |  3 +++
 modules/vault_cluster/main.tf       | 37 +++++++++++++++++++++++++++++
 modules/vault_cluster/variables.tf  | 30 +++++++++++++++++++++++
 4 files changed, 83 insertions(+)

diff --git a/config/config.hcl b/config/config.hcl
index cb6193f..f675790 100644
--- a/config/config.hcl
+++ b/config/config.hcl
@@ -266,5 +266,18 @@ locals {
       })
       if startswith(file_path, "netbox_secret_backend_role/")
     }
+    ghp_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "ghp_secret_backend/")
+    }
+    ghp_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "ghp_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "ghp_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "ghp_secret_backend_role/")
+    }
   }
 }
diff --git a/environments/au/syd1/terragrunt.hcl b/environments/au/syd1/terragrunt.hcl
index 44b3338..d12385e 100644
--- a/environments/au/syd1/terragrunt.hcl
+++ b/environments/au/syd1/terragrunt.hcl
@@ -90,6 +90,9 @@ inputs = {
   netbox_secret_backend      = local.config.netbox_secret_backend
   netbox_secret_backend_role = local.config.netbox_secret_backend_role
 
+  ghp_secret_backend      = local.config.ghp_secret_backend
+  ghp_secret_backend_role = local.config.ghp_secret_backend_role
+
   # Pass policy maps to vault_cluster module
   policy_auth_map  = local.policies.policy_auth_map
   policy_rules_map = local.policies.policy_rules_map
diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf
index 459a4f5..a910dbd 100644
--- a/modules/vault_cluster/main.tf
+++ b/modules/vault_cluster/main.tf
@@ -536,6 +536,43 @@ module "netbox_secret_backend_role" {
   depends_on = [module.netbox_secret_backend, module.netbox_user_management]
 }
 
+module "ghp_secret_backend" {
+  source = "./modules/ghp_secret_backend"
+
+  for_each = var.ghp_secret_backend
+
+  path                    = each.key
+  plugin                  = each.value.plugin
+  description             = each.value.description
+  base_url                = each.value.base_url
+  country                 = var.country
+  region                  = var.region
+  ca_cert                 = each.value.ca_cert
+  tls_skip_verify         = each.value.tls_skip_verify
+  request_timeout_seconds = each.value.request_timeout_seconds
+
+  depends_on = [module.plugin]
+}
+
+module "ghp_secret_backend_role" {
+  source = "./modules/ghp_secret_backend_role"
+
+  for_each = var.ghp_secret_backend_role
+
+  backend         = each.value.backend
+  name            = each.value.name
+  token_type      = each.value.token_type
+  installation_id = each.value.installation_id
+  app_record_id   = each.value.app_record_id
+  repositories    = each.value.repositories
+  scopes          = each.value.scopes
+  session_prefix  = each.value.session_prefix
+  ttl             = each.value.ttl
+  max_ttl         = each.value.max_ttl
+
+  depends_on = [module.ghp_secret_backend]
+}
+
 module "vault_policy" {
   source = "./modules/vault_policy"
 
diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf
index 01814f8..ff53cf8 100644
--- a/modules/vault_cluster/variables.tf
+++ b/modules/vault_cluster/variables.tf
@@ -468,6 +468,36 @@ variable "netbox_backend_aliases" {
   default     = {}
 }
 
+variable "ghp_secret_backend" {
+  description = "Map of ghp token secret engines to create (mount + config; seeded service token read from KV)"
+  type = map(object({
+    plugin                  = optional(string, "vault-plugin-secrets-ghp")
+    description             = optional(string)
+    base_url                = string
+    ca_cert                 = optional(string)
+    tls_skip_verify         = optional(bool, false)
+    request_timeout_seconds = optional(number, 30)
+  }))
+  default = {}
+}
+
+variable "ghp_secret_backend_role" {
+  description = "Map of ghp engine roles; reading ghp/creds/<name> mints a short-lived scoped ghp token"
+  type = map(object({
+    name            = string
+    backend         = string
+    token_type      = optional(string)
+    installation_id = optional(number)
+    app_record_id   = optional(string)
+    repositories    = optional(list(string))
+    scopes          = optional(list(string))
+    session_prefix  = optional(string)
+    ttl             = optional(number)
+    max_ttl         = optional(number)
+  }))
+  default = {}
+}
+
 variable "policy_auth_map" {
   description = "Map of auth mounts -> auth roles -> policy names"
   type        = map(map(list(string)))