Register + mount the GPG secrets engine at gpg/ (#87)

Complete the deploy of the [vault-plugin-secrets-gpg](https://git.unkin.net/unkin/vault-plugin-secrets-gpg) engine. Puppet ([puppet-prod #480](unkin/puppet-prod#480)) installs the `openbao-plugin-secrets-gpg` RPM onto the OpenBao nodes; this registers that binary in the plugin catalog and enables the secrets engine so `gpg/` is actually usable.

- Add a `gpg_secret_backend` module using the standard `hashicorp/vault` provider (already required at 5.6.0): `vault_plugin` (catalog register with a pinned sha256) + `vault_mount` (enable at the mount path).
- Wire it through `vault_cluster` (new `gpg_secret_backend` variable + module block) and the config discovery (`config.hcl` group + syd1 terragrunt input), mirroring `litellm_secret_backend`.
- Add `config/gpg_secret_backend/gpg.yaml` mounting at `gpg/` and pinning the released v0.1.0 binary sha256 (`0e92d740…a7b20`, extracted from the published RPM). Puppet installs the RPM floating, so this sha must be bumped in lockstep on any plugin upgrade or OpenBao rejects the binary.

Validated locally with `tofu validate` + `tofu fmt`. Granting non-root access to `gpg/*` (auth roles + policies) is a follow-up scoped to whoever consumes the engine (e.g. passv from CI).

Reviewed-on: #87
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

.gitignore

@@ -1,3 +1,4 @@
 .terraform
 .terraform.lock.hcl
 env
+.terragrunt-cache

.pre-commit-config.yaml

@@ -1,9 +1,16 @@
 repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: end-of-file-fixer
+        types: [yaml]
+      - id: trailing-whitespace
+        types: [yaml]
   - repo: https://github.com/gruntwork-io/pre-commit
     rev: v0.1.30
     hooks:
-      - id: terraform-fmt
+      - id: tofu-fmt
-      - id: terraform-validate
+      - id: tofu-validate
       - id: tflint
       - id: terragrunt-hcl-fmt
   - repo: https://github.com/adrienverge/yamllint.git

.woodpecker/apply.yaml

@@ -0,0 +1,23 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: apply
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+      - make apply
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/plan.yaml

@@ -0,0 +1,21 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: plan
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/pre-commit.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

Makefile

@@ -1,20 +1,35 @@
-.PHONY: init plan apply help
+.PHONY: init plan apply format
 
-# Default target
+VAULT_AUTH_METHOD ?= approle
-help:
+VAULT_K8S_ROLE ?= woodpecker_terraform_vault
-	@echo "Available targets:"
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
-	@echo "  init  - Initialize Terraform"
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
-	@echo "  plan  - Plan Terraform changes"
+
-	@echo "  apply - Apply Terraform changes"
+# Define vault_env function to set up vault environment
+define vault_env
+	@export VAULT_ADDR="https://vault.service.consul:8200" && \
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
+	else \
+		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
+	fi && \
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
+endef
 
 init:
-	@echo "Sourcing environment and initializing Terraform..."
+	@$(call vault_env) && \
-	@source ./env && terraform init
+	terragrunt run --all --non-interactive init -- -upgrade
 
-plan:
+plan: init
-	@echo "Sourcing environment and planning Terraform changes..."
+	@$(call vault_env) && \
-	@source ./env && terraform plan
+	terragrunt run --all --parallelism 4 --non-interactive plan
 
-apply:
+apply: init
-	@echo "Sourcing environment and applying Terraform changes..."
+	@$(call vault_env) && \
-	@source ./env && terraform apply -auto-approve
+	terragrunt run --all --parallelism 2 --non-interactive apply
+
+format:
+	@echo "Formatting OpenTofu files..."
+	@tofu fmt -recursive .
+	@echo "Formatting Terragrunt files..."
+	@terragrunt hcl fmt

auth_approle_certmanager.tf

@@ -1,15 +0,0 @@
-resource "vault_approle_auth_backend_role" "certmanager" {
-  role_name      = "certmanager"
-  bind_secret_id = false
-  token_policies = ["pki_int/certmanager"]
-  token_ttl      = 30
-  token_max_ttl  = 30
-  token_bound_cidrs = [
-    "198.18.25.5/32",   # ausyd1nxvm2052.main.unkin.net
-    "198.18.26.3/32",   # ausyd1nxvm2053.main.unkin.net
-    "198.18.27.89/32",  # ausyd1nxvm2054.main.unkin.net
-    "198.18.28.8/32",   # ausyd1nxvm2055.main.unkin.net
-    "198.18.29.33/32",  # ausyd1nxvm2056.main.unkin.net
-    "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
-  ]
-}

auth_approle_incus_cluster.tf

@@ -1,16 +0,0 @@
-resource "vault_approle_auth_backend_role" "incus_cluster" {
-  role_name      = "incus_cluster"
-  bind_secret_id = false
-  token_policies = [
-    "default_access",
-    "kv/service/incus/incus-cluster-join-tokens"
-  ]
-  token_ttl     = 60
-  token_max_ttl = 120
-  token_bound_cidrs = [
-    "10.10.12.200/32",
-    "198.18.13.77/32",
-    "198.18.13.78/32",
-    "198.18.13.79/32"
-  ]
-}

auth_approle_packer_builder.tf

@@ -1,16 +0,0 @@
-resource "vault_approle_auth_backend_role" "packer_builder" {
-  role_name      = "packer_builder"
-  bind_secret_id = false
-  token_policies = [
-    "default_access",
-    "kv/service/packer/packer_builder",
-  ]
-  token_ttl     = 300 # builds can take a few minutes
-  token_max_ttl = 600
-  token_bound_cidrs = [
-    "10.10.12.200/32",
-    "198.18.25.102/32",
-    "198.18.26.91/32",
-    "198.18.27.40/32",
-  ]
-}

auth_approle_puppetapi.tf

@@ -1,15 +0,0 @@
-resource "vault_approle_auth_backend_role" "puppetapi" {
-  role_name      = "puppetapi"
-  bind_secret_id = false
-  token_policies = ["kv/service/puppetapi/puppetapi_read_tokens"]
-  token_ttl      = 30
-  token_max_ttl  = 30
-  token_bound_cidrs = [
-    "198.18.25.5/32",   # ausyd1nxvm2052.main.unkin.net
-    "198.18.26.3/32",   # ausyd1nxvm2053.main.unkin.net
-    "198.18.27.89/32",  # ausyd1nxvm2054.main.unkin.net
-    "198.18.28.8/32",   # ausyd1nxvm2055.main.unkin.net
-    "198.18.29.33/32",  # ausyd1nxvm2056.main.unkin.net
-    "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
-  ]
-}

auth_approle_rpmbuilder.tf

@@ -1,16 +0,0 @@
-resource "vault_approle_auth_backend_role" "rpmbuilder" {
-  role_name      = "rpmbuilder"
-  bind_secret_id = false
-  token_policies = [
-    "kv/service/github/neoloc/tokens/read-only-token/read",
-    "kv/service/gitea/unkinben/tokens/read-only-packages/read",
-  ]
-  token_ttl     = 30
-  token_max_ttl = 30
-  token_bound_cidrs = [
-    "10.10.12.200/32",
-    "198.18.25.102/32",
-    "198.18.26.91/32",
-    "198.18.27.40/32",
-  ]
-}

auth_approle_rundeck-role.tf

@@ -1,9 +0,0 @@
-resource "vault_approle_auth_backend_role" "rundeck-role" {
-  role_name             = "rundeck-role"
-  bind_secret_id        = true
-  token_policies        = ["rundeck/rundeck"]
-  token_ttl             = 1 * 3600
-  token_max_ttl         = 4 * 3600
-  token_bound_cidrs     = ["198.18.13.59/32"]
-  secret_id_bound_cidrs = ["198.18.13.59/32"]
-}

auth_approle_sshsign-host-role.tf

@@ -1,15 +0,0 @@
-resource "vault_approle_auth_backend_role" "sshsign-host-role" {
-  role_name      = "sshsign-host-role"
-  bind_secret_id = false
-  token_policies = ["ssh-host-signer/sshsign-host-policy"]
-  token_ttl      = 30
-  token_max_ttl  = 30
-  token_bound_cidrs = [
-    "198.18.25.5/32",   # ausyd1nxvm2052.main.unkin.net
-    "198.18.26.3/32",   # ausyd1nxvm2053.main.unkin.net
-    "198.18.27.89/32",  # ausyd1nxvm2054.main.unkin.net
-    "198.18.28.8/32",   # ausyd1nxvm2055.main.unkin.net
-    "198.18.29.33/32",  # ausyd1nxvm2056.main.unkin.net
-    "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
-  ]
-}

auth_approle_sshsigner.tf

@@ -1,18 +0,0 @@
-resource "vault_approle_auth_backend_role" "sshsigner" {
-  role_name      = "sshsigner"
-  bind_secret_id = false
-  token_policies = [
-    "ssh-host-signer/sshsigner",
-    "sshca_signhost"
-  ]
-  token_ttl     = 30
-  token_max_ttl = 30
-  token_bound_cidrs = [
-    "198.18.25.5/32",   # ausyd1nxvm2052.main.unkin.net
-    "198.18.26.3/32",   # ausyd1nxvm2053.main.unkin.net
-    "198.18.27.89/32",  # ausyd1nxvm2054.main.unkin.net
-    "198.18.28.8/32",   # ausyd1nxvm2055.main.unkin.net
-    "198.18.29.33/32",  # ausyd1nxvm2056.main.unkin.net
-    "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
-  ]
-}

auth_approle_terraform_incus.tf

@@ -1,17 +0,0 @@
-resource "vault_approle_auth_backend_role" "terraform_incus" {
-  role_name      = "terraform_incus"
-  bind_secret_id = false
-  token_policies = [
-    "default_access",
-    "kv/service/terraform/incus",
-    "kv/service/puppet/certificates/terraform_puppet_cert",
-  ]
-  token_ttl     = 60
-  token_max_ttl = 120
-  token_bound_cidrs = [
-    "10.10.12.200/32",
-    "198.18.25.102/32",
-    "198.18.26.91/32",
-    "198.18.27.40/32",
-  ]
-}

auth_approle_terraform_nomad.tf

@@ -1,16 +0,0 @@
-resource "vault_approle_auth_backend_role" "terraform_nomad" {
-  role_name      = "terraform_nomad"
-  bind_secret_id = false
-  token_policies = [
-    "default_access",
-    "kv/service/terraform/nomad",
-  ]
-  token_ttl     = 60
-  token_max_ttl = 120
-  token_bound_cidrs = [
-    "10.10.12.200/32",
-    "198.18.25.102/32",
-    "198.18.26.91/32",
-    "198.18.27.40/32",
-  ]
-}

auth_approle_terraform_repoflow.tf

@@ -1,17 +0,0 @@
-resource "vault_approle_auth_backend_role" "terraform_repoflow" {
-  role_name      = "terraform_repoflow"
-  bind_secret_id = false
-  token_policies = [
-    "default_access",
-    "kv/service/repoflow/unkinadmin/tokens/terraform/read",
-    "kv/service/terraform/repoflow",
-  ]
-  token_ttl     = 60
-  token_max_ttl = 120
-  token_bound_cidrs = [
-    "10.10.12.200/32",
-    "198.18.25.102/32",
-    "198.18.26.91/32",
-    "198.18.27.40/32",
-  ]
-}

auth_approle_tf_vault.tf

@@ -1,33 +0,0 @@
-resource "vault_approle_auth_backend_role" "tf_vault" {
-  role_name      = "tf_vault"
-  bind_secret_id = false
-  token_policies = [
-    "default_access",
-    "approle_token_create",
-    "auth/approle/approle_role_admin",
-    "auth/approle/approle_role_login",
-    "auth/kubernetes/k8s_auth_admin",
-    "auth/ldap/ldap_admin",
-    "auth/token/auth_token_create",
-    "auth/token/auth_token_self",
-    "auth/token/auth_token_roles_admin",
-    "kubernetes/au/config_admin",
-    "kubernetes/au/roles_admin",
-    "kv/service/glauth/services/svc_vault_read",
-    "kv/service/kubernetes/au/syd1/token_reviewer_jwt/read",
-    "kv/service/kubernetes/au/syd1/service_account_jwt/read",
-    "pki_int/pki_int_roles_admin",
-    "pki_root/pki_root_roles_admin",
-    "ssh-host-signer/ssh-host-signer_roles_admin",
-    "sshca/sshca_roles_admin",
-    "sys/sys_auth_admin",
-    "sys/sys_mounts_admin",
-    "sys/sys_policy_admin",
-    "transit/keys/admin",
-  ]
-  token_ttl     = 60
-  token_max_ttl = 120
-  token_bound_cidrs = [
-    "10.10.12.200/32",
-  ]
-}

auth_backend_approle.tf

@@ -1,7 +0,0 @@
-#----------------------------
-# Enable approle auth method
-#----------------------------
-resource "vault_auth_backend" "approle" {
-  type = "approle"
-  path = "approle"
-}

auth_backend_kubernetes.tf

@@ -1,23 +0,0 @@
-#-----------------------------------
-# Enable kubernetes auth method
-#-----------------------------------
-resource "vault_auth_backend" "kubernetes" {
-  type = "kubernetes"
-  path = "kubernetes"
-}
-
-# Data source to read the token_reviewer_jwt from Vault KV
-data "vault_kv_secret_v2" "token_reviewer_jwt_au_syd1" {
-  mount = "kv"
-  name  = "service/kubernetes/au/syd1/token_reviewer_jwt"
-}
-
-# Configure Kubernetes auth backend
-resource "vault_kubernetes_auth_backend_config" "config" {
-  backend                           = vault_auth_backend.kubernetes.path
-  kubernetes_host                   = "https://api-k8s.service.consul:6443"
-  kubernetes_ca_cert                = local.kubernetes_ca_cert_au_syd1
-  token_reviewer_jwt                = data.vault_kv_secret_v2.token_reviewer_jwt_au_syd1.data["token"]
-  disable_iss_validation            = true
-  use_annotations_as_alias_metadata = true
-}

auth_backend_ldap.tf

@@ -1,40 +0,0 @@
-#--------------------------------
-# Enable ldap auth method
-#--------------------------------
-
-# retrieve the bindpass from Vault
-data "vault_generic_secret" "svc_vault" {
-  path = "kv/service/glauth/services/svc_vault"
-}
-
-# create the ldap backend
-resource "vault_ldap_auth_backend" "ldap" {
-  path        = "ldap"
-  url         = "ldap://ldap.service.consul"
-  userdn      = "ou=people,ou=users,dc=main,dc=unkin,dc=net"
-  userattr    = "uid"
-  upndomain   = "users.main.unkin.net"
-  discoverdn  = false
-  groupdn     = "ou=users,dc=main,dc=unkin,dc=net"
-  groupfilter = "(&(objectClass=posixGroup)(memberUid={{.Username}}))"
-  groupattr   = "uid"
-  binddn      = data.vault_generic_secret.svc_vault.data["distinguishedName"]
-  bindpass    = data.vault_generic_secret.svc_vault.data["pass"]
-}
-
-resource "vault_ldap_auth_backend_group" "vault_access" {
-  groupname = "vault_access"
-  policies = [
-    "default_access",
-  ]
-  backend = vault_ldap_auth_backend.ldap.path
-}
-
-resource "vault_ldap_auth_backend_group" "vault_admin" {
-  groupname = "vault_admin"
-  policies = [
-    "default_access",
-    "global-admin",
-  ]
-  backend = vault_ldap_auth_backend.ldap.path
-}

auth_kubernetes_roles.tf

@@ -1,118 +0,0 @@
-resource "vault_kubernetes_auth_backend_role" "default" {
-  backend                          = vault_auth_backend.kubernetes.path
-  role_name                        = "default"
-  bound_service_account_names      = ["default"]
-  bound_service_account_namespaces = ["*"]
-  token_ttl                        = 3600
-  token_policies = [
-    "default"
-  ]
-  audience = "vault"
-}
-
-resource "vault_kubernetes_auth_backend_role" "demo_default" {
-  backend                          = vault_auth_backend.kubernetes.path
-  role_name                        = "demo_default"
-  bound_service_account_names      = ["default"]
-  bound_service_account_namespaces = ["demo"]
-  token_ttl                        = 60
-  token_policies = [
-    "kv/service/terraform/nomad"
-  ]
-  audience = "vault"
-}
-
-resource "vault_kubernetes_auth_backend_role" "huntarr-default" {
-  backend                          = vault_auth_backend.kubernetes.path
-  role_name                        = "huntarr-default"
-  bound_service_account_names      = ["default"]
-  bound_service_account_namespaces = ["huntarr"]
-  token_ttl                        = 60
-  token_policies = [
-    "pki_int/sign/servers_default",
-    "pki_int/issue/servers_default",
-  ]
-  audience = "vault"
-}
-
-resource "vault_kubernetes_auth_backend_role" "externaldns" {
-  backend                          = vault_auth_backend.kubernetes.path
-  role_name                        = "externaldns"
-  bound_service_account_names      = ["externaldns"]
-  bound_service_account_namespaces = ["externaldns"]
-  token_ttl                        = 60
-  token_policies = [
-    "kv/service/kubernetes/au/syd1/externaldns/tsig/read",
-  ]
-  audience = "vault"
-}
-
-resource "vault_kubernetes_auth_backend_role" "cert_manager_issuer" {
-  backend                          = vault_auth_backend.kubernetes.path
-  role_name                        = "cert-manager-issuer"
-  bound_service_account_names      = ["cert-manager-vault-issuer"]
-  bound_service_account_namespaces = ["cert-manager"]
-  token_ttl                        = 60
-  token_policies = [
-    "pki_int/sign/servers_default",
-    "pki_int/issue/servers_default",
-  ]
-  audience = "vault"
-}
-
-resource "vault_kubernetes_auth_backend_role" "ceph-csi" {
-  backend   = vault_auth_backend.kubernetes.path
-  role_name = "ceph-csi"
-  bound_service_account_names = [
-    "ceph-csi-rbd-csi-rbd-provisioner",
-    "ceph-csi-cephfs-csi-cephfs-provisioner",
-  ]
-  bound_service_account_namespaces = [
-    "csi-cephrbd",
-    "csi-cephfs",
-  ]
-  token_ttl = 60
-  token_policies = [
-    "kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read",
-    "kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read",
-  ]
-  audience = "vault"
-}
-
-resource "vault_kubernetes_auth_backend_role" "media-apps" {
-  backend   = vault_auth_backend.kubernetes.path
-  role_name = "media-apps"
-  bound_service_account_names = [
-    "media-apps-vault-reader",
-  ]
-  bound_service_account_namespaces = [
-    "media-apps",
-  ]
-  token_ttl = 60
-  token_policies = [
-    "kv/service/media-apps/prowlarr/read",
-    "kv/service/media-apps/radarr/read",
-    "kv/service/media-apps/sonarr/read",
-  ]
-  audience = "vault"
-}
-
-resource "vault_kubernetes_auth_backend_role" "repoflow" {
-  backend   = vault_auth_backend.kubernetes.path
-  role_name = "repoflow"
-  bound_service_account_names = [
-    "default",
-  ]
-  bound_service_account_namespaces = [
-    "repoflow",
-  ]
-  token_ttl = 60
-  token_policies = [
-    "kv/service/repoflow/au/syd1/ceph-s3/read",
-    "kv/service/repoflow/au/syd1/elasticsearch/read",
-    "kv/service/repoflow/au/syd1/hasura/read",
-    "kv/service/repoflow/au/syd1/postgres/read",
-    "kv/service/repoflow/au/syd1/repoflow-server/read",
-  ]
-  audience = "vault"
-}

config/auth_approle_backend/approle.yaml

@@ -0,0 +1,2 @@
+default_lease_ttl: 60s
+max_lease_ttl: 24h

config/auth_approle_role/approle/certmanager.yaml

@@ -0,0 +1,11 @@
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "198.18.25.5/32"
+  - "198.18.26.3/32"
+  - "198.18.27.89/32"
+  - "198.18.28.8/32"
+  - "198.18.29.33/32"
+  - "198.18.29.239/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/incus_cluster.yaml

@@ -0,0 +1,9 @@
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.13.77/32"
+  - "198.18.13.78/32"
+  - "198.18.13.79/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/packer_builder.yaml

@@ -0,0 +1,9 @@
+token_ttl: 300
+token_max_ttl: 600
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/puppetapi.yaml

@@ -0,0 +1,11 @@
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "198.18.25.5/32"
+  - "198.18.26.3/32"
+  - "198.18.27.89/32"
+  - "198.18.28.8/32"
+  - "198.18.29.33/32"
+  - "198.18.29.239/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/rpmbuilder.yaml

@@ -0,0 +1,9 @@
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/rundeck-role.yaml

@@ -0,0 +1,6 @@
+token_ttl: 3600
+token_max_ttl: 14400
+bind_secret_id: true
+token_bound_cidrs:
+  - "198.18.13.59/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/sshsigner.yaml

@@ -0,0 +1,11 @@
+token_ttl: 30
+token_max_ttl: 30
+bind_secret_id: false
+token_bound_cidrs:
+  - "198.18.25.5/32"
+  - "198.18.26.3/32"
+  - "198.18.27.89/32"
+  - "198.18.28.8/32"
+  - "198.18.29.33/32"
+  - "198.18.29.239/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/terraform_artifactapi.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_authentik.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_git.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_incus.yaml

@@ -0,0 +1,9 @@
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/terraform_k8s.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_ldap.yaml

@@ -0,0 +1,9 @@
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_nomad.yaml

@@ -0,0 +1,9 @@
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/terraform_prowlarr.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_radarr.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_rancher.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/terraform_repoflow.yaml

@@ -0,0 +1,9 @@
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: false

config/auth_approle_role/approle/terraform_sonarr.yaml

@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true

config/auth_approle_role/approle/tf_vault.yaml

@@ -0,0 +1,6 @@
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+use_deterministic_role_id: false

config/auth_kubernetes_backend/k8s/au/syd1.yaml

@@ -0,0 +1,5 @@
+kubernetes_host: https://api-k8s.service.consul:6443
+disable_iss_validation: true
+use_annotations_as_alias_metadata: false # doesnt work with openbao yet
+default_lease_ttl: 1h
+max_lease_ttl: 24h

config/auth_kubernetes_role/k8s/au/syd1/artifactapi.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - artifactapi
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/ceph-csi.yaml

@@ -0,0 +1,9 @@
+bound_service_account_names:
+  - ceph-csi-rbd-csi-rbd-provisioner
+  - ceph-csi-cephfs-csi-cephfs-provisioner
+bound_service_account_namespaces:
+  - csi-cephrbd
+  - csi-cephfs
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/cert_manager_issuer.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - cert-manager-vault-issuer
+bound_service_account_namespaces:
+  - cert-manager
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/default.yaml

@@ -0,0 +1,6 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces: ['*']
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/externaldns.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - externaldns
+bound_service_account_namespaces:
+  - externaldns
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/huntarr-default.yaml

@@ -0,0 +1,6 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - huntarr
+token_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/identity.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - identity
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/media-apps.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - media-apps-vault-reader
+bound_service_account_namespaces:
+  - media-apps
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/puppet.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/rancher.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - rancher
+bound_service_account_namespaces:
+  - cattle-system
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/repoflow.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - repoflow
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/rpmbuilder.yaml

@@ -0,0 +1,8 @@
+# rpmbuilder is deployed in woodpeckerci
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_artifactapi.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-artifactapi
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_authentik.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-authentik
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_git.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-git
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_prowlarr.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-prowlarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_radarr.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-radarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_rancher.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-rancher
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_sonarr.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-sonarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_vault.yaml

@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-vault
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local

config/auth_ldap_backend/ldap.yaml

@@ -0,0 +1,10 @@
+userdn: "ou=people,ou=users,dc=main,dc=unkin,dc=net"
+userattr: "uid"
+upndomain: "users.main.unkin.net"
+discoverdn: false
+groupdn: "ou=users,dc=main,dc=unkin,dc=net"
+groupfilter: "(&(objectClass=posixGroup)(memberUid={{.Username}}))"
+groupattr: "uid"
+username_as_alias: true
+default_lease_ttl: 24h
+max_lease_ttl: 168h

config/auth_ldap_group/ldap/kubernetes_au_syd1_cluster_admin.yaml

@@ -0,0 +1,3 @@
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo

config/auth_ldap_group/ldap/kubernetes_au_syd1_cluster_operator.yaml

@@ -0,0 +1,3 @@
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo

config/auth_ldap_group/ldap/kubernetes_au_syd1_cluster_root.yaml

@@ -0,0 +1,3 @@
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo

config/auth_ldap_group/ldap/vault_admin.yaml

@@ -0,0 +1,3 @@
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo

config/config.hcl

@@ -0,0 +1,222 @@
+# =============================================================================
+# VAULT MODULE CONFIGURATION SYSTEM
+# =============================================================================
+#
+# This file automatically discovers and organizes YAML configuration files
+# for Vault modules, creating structured configuration maps for Terraform.
+#
+# HOW IT WORKS:
+# 1. Scans all subdirectories for *.yaml files
+# 2. Groups files by module type based on directory structure
+# 3. Creates unique resource keys to prevent naming conflicts
+# 4. Adds computed fields like name, backend, etc. from file paths
+#
+# DIRECTORY STRUCTURE:
+# config/
+# ├── auth_approle_role/
+# │   └── approle/
+# │       ├── certmanager.yaml    # Creates key: "approle/certmanager"
+# │       └── myapp.yaml          # Creates key: "approle/myapp"
+# ├── auth_kubernetes_role/
+# │   └── k8s/au/syd1/
+# │       ├── default.yaml        # Creates key: "k8s/au/syd1/default"
+# │       └── myapp.yaml          # Creates key: "k8s/au/syd1/myapp"
+# └── kv_secret_backend/
+#     ├── kv.yaml                 # Creates key: "kv"
+#     └── secrets.yaml            # Creates key: "secrets"
+#
+# EXAMPLE YAML FILE (config/auth_approle_role/approle/myapp.yaml):
+# ```yaml
+# token_ttl: 3600
+# token_max_ttl: 7200
+# bind_secret_id: true
+# token_bound_cidrs:
+#   - "10.0.0.0/8"
+# ```
+#
+# This becomes:
+# ```hcl
+# auth_approle_role = {
+#   "approle/myapp" = {
+#     approle_name = "myapp"        # Auto-computed from filename
+#     mount_path = "approle"        # Auto-computed from directory
+#     token_ttl = 3600              # From YAML content
+#     token_max_ttl = 7200          # From YAML content
+#     bind_secret_id = true         # From YAML content
+#     token_bound_cidrs = ["10.0.0.0/8"]
+#   }
+# }
+# ```
+#
+# KEY NAMING PATTERNS:
+# - Simple backends: filename only (e.g., "kv", "transit")
+# - Role-based resources: full path without extension (e.g., "approle/myapp")
+# - This ensures uniqueness when multiple backends have similar role names
+#
+# GENERATED OUTPUTS:
+# - config.auth_approle_backend, config.auth_approle_role, etc.
+# - Each module gets its own map with properly structured configuration
+#
+# =============================================================================
+
+locals {
+  # Find all YAML files in subdirectories
+  config_files = fileset(".", "**/*.yaml")
+
+  # Create a flat map of all files with their content
+  all_configs = {
+    for file_path in local.config_files :
+    file_path => yamldecode(file(file_path))
+  }
+
+  # Group by module directory (first part of path)
+  config = {
+    auth_approle_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "auth_approle_backend/")
+    }
+    auth_approle_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "auth_approle_role/", ""), ".yaml") => merge(content, {
+        approle_name = trimsuffix(basename(file_path), ".yaml")
+        mount_path   = split("/", replace(file_path, "auth_approle_role/", ""))[0]
+      })
+      if startswith(file_path, "auth_approle_role/")
+    }
+    auth_ldap_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "auth_ldap_backend/")
+    }
+    auth_ldap_group = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "auth_ldap_group/", ""), ".yaml") => merge(content, {
+        groupname = trimsuffix(basename(file_path), ".yaml")
+        backend   = split("/", replace(file_path, "auth_ldap_group/", ""))[0]
+      })
+      if startswith(file_path, "auth_ldap_group/")
+    }
+    auth_kubernetes_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "auth_kubernetes_backend/", ""), ".yaml") => content
+      if startswith(file_path, "auth_kubernetes_backend/")
+    }
+    auth_kubernetes_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "auth_kubernetes_role/", ""), ".yaml") => merge(content, {
+        role_name = trimsuffix(basename(file_path), ".yaml")
+        backend   = dirname(replace(file_path, "auth_kubernetes_role/", ""))
+      })
+      if startswith(file_path, "auth_kubernetes_role/")
+    }
+    kv_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "kv_secret_backend/")
+    }
+    transit_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "transit_secret_backend/")
+    }
+    transit_secret_backend_key = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "transit_secret_backend_key/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "transit_secret_backend_key/", ""))
+      })
+      if startswith(file_path, "transit_secret_backend_key/")
+    }
+    ssh_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "ssh_secret_backend/")
+    }
+    ssh_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "ssh_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "ssh_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "ssh_secret_backend_role/")
+    }
+    pki_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "pki_secret_backend/", ""), ".yaml") => content
+      if startswith(file_path, "pki_secret_backend/")
+    }
+    pki_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "pki_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "pki_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "pki_secret_backend_role/")
+    }
+    kubernetes_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "kubernetes_secret_backend/", ""), ".yaml") => content
+      if startswith(file_path, "kubernetes_secret_backend/")
+    }
+    kubernetes_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "kubernetes_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "kubernetes_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "kubernetes_secret_backend_role/")
+    }
+    consul_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "consul_secret_backend/", ""), ".yaml") => content
+      if startswith(file_path, "consul_secret_backend/")
+    }
+    consul_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "consul_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "consul_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "consul_secret_backend_role/")
+    }
+    pki_mount_only = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "pki_mount_only/")
+    }
+    litellm_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "litellm_secret_backend/")
+    }
+    litellm_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "litellm_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "litellm_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "litellm_secret_backend_role/")
+    }
+    plugins = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => merge(content, {
+        name = trimsuffix(basename(file_path), ".yaml")
+      })
+      if startswith(file_path, "plugins/")
+    }
+    gpg_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "gpg_secret_backend/")
+    }
+    gpg_key = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "gpg_key/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "gpg_key/", ""))
+      })
+      if startswith(file_path, "gpg_key/")
+    }
+  }
+}

config/consul_secret_backend/consul_root/au/syd1.yaml

@@ -0,0 +1,7 @@
+description: "consul secret engine for au-syd1 cluster"
+default_lease_ttl_seconds: 600
+max_lease_ttl_seconds: 86400
+address: "consul.service.au-syd1.consul"
+scheme: https
+bootstrap: false
+datacenter: au-syd1

config/consul_secret_backend_role/consul_root/au/syd1/terraform-artifactapi.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-artifactapi
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-authentik.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-authentik
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-git.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-git
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-incus.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-incus
+ttl: 300
+max_ttl: 600
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-k8s.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-k8s
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-ldap.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-ldap
+ttl: 60
+max_ttl: 60
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-nomad.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-nomad
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-prowlarr.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-prowlarr
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-radarr.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-radarr
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-rancher.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-rancher
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-repoflow.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-repoflow
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-sonarr.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-sonarr
+ttl: 120
+max_ttl: 300
+datacenters: []

config/consul_secret_backend_role/consul_root/au/syd1/terraform-vault.yaml

@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-vault
+ttl: 120
+max_ttl: 300
+datacenters: []

config/gpg_key/gpg/pass.yaml

@@ -0,0 +1,7 @@
+# config/gpg_key/gpg/pass.yaml
+# An OpenPGP key in the gpg engine for password-store (passv). The private key
+# stays in Vault; clients import the exported public key to encrypt and delegate
+# decryption to gpg/decrypt/pass. Key name = "pass", backend = "gpg".
+algorithm: rsa-4096
+identity: "pass <pass@unkin.net>"
+exportable: false

config/gpg_secret_backend/gpg.yaml

@@ -0,0 +1,4 @@
+# config/gpg_secret_backend/gpg.yaml
+# Mounts the gpg secrets engine at "gpg". The plugin itself is registered in the
+# catalog separately (see config/plugins/vault-plugin-secrets-gpg.yaml).
+description: "GPG/OpenPGP secrets engine (sign/verify/encrypt/decrypt)"

config/kubernetes_secret_backend/kubernetes/au/syd1.yaml

@@ -0,0 +1,5 @@
+description: "kubernetes secret engine for au-syd1 cluster"
+default_lease_ttl_seconds: 600
+max_lease_ttl_seconds: 86400
+kubernetes_host: "https://api-k8s.service.consul:6443"
+disable_local_ca_jwt: false

config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-admin.yaml

@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "*"
+kubernetes_role_type: "ClusterRole"
+extra_labels: {}

config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-operator.yaml

@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "*"
+kubernetes_role_type: "ClusterRole"
+extra_labels: {}

config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-root.yaml

@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "*"
+kubernetes_role_type: "ClusterRole"
+extra_labels: {}

config/kubernetes_secret_backend_role/kubernetes/au/syd1/media-apps-operator.yaml

@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "media-apps"
+kubernetes_role_type: "Role"
+extra_labels: {}

config/kv_secret_backend/kv.yaml

@@ -0,0 +1,4 @@
+type: kv-v2
+description: "Key-Value secrets engine"
+version: "2"
+max_versions: 10

config/kv_secret_backend/rundeck.yaml

@@ -0,0 +1,4 @@
+type: kv-v2
+description: "Rundeck secrets engine"
+version: "2"
+max_versions: 5

config/litellm_secret_backend/litellm.yaml

@@ -0,0 +1,6 @@
+# Mounts the LiteLLM dynamic secrets engine at "litellm" and writes its config.
+# The master key is sensitive and read from KV, not stored here:
+#   kv/service/vault/au/syd1/secret_backend/litellm -> key "master_key"
+description: "LiteLLM dynamic virtual keys"
+base_url: "https://litellm.k8s.syd1.au.unkin.net"
+request_timeout_seconds: 30

config/litellm_secret_backend_role/litellm/opus47.yaml

@@ -0,0 +1,9 @@
+---
+models:
+  - claude-opus-4-7
+max_budget: 5
+ttl: 3600      # seconds (1h)
+max_ttl: 86400 # seconds (24h)
+metadata:
+  team: testuser
+  env: prod

config/litellm_secret_backend_role/litellm/rspamd.yaml

@@ -0,0 +1,10 @@
+---
+models:
+  - claude-haiku-4-5
+  - claude-sonnet-4-6
+max_budget: 50
+ttl: 3600      # seconds (1h)
+max_ttl: 86400 # seconds (24h)
+metadata:
+  team: mailfiltering
+  env: prod

config/pki_mount_only/pki_int.yaml

@@ -0,0 +1,17 @@
+description: "PKI Intermediate CA"
+max_lease_ttl_seconds: 157680000  # 43800 hours * 3600
+issuer_ref: "default"
+issuing_certificates:
+  - "https://vault.service.consul:8200/v1/pki_int/ca"
+crl_distribution_points:
+  - "https://vault.service.consul:8200/v1/pki_int/crl"
+ocsp_servers: []
+enable_templating: false
+default_issuer_ref: null
+default_follows_latest_issuer: false
+crl_expiry: "72h"
+crl_disable: false
+ocsp_disable: false
+auto_rebuild: false
+enable_delta: false
+delta_rebuild_interval: null

config/pki_mount_only/pki_root.yaml

@@ -0,0 +1,17 @@
+description: "PKI Root CA"
+max_lease_ttl_seconds: 315360000  # 10 years
+issuer_ref: "default"
+issuing_certificates:
+  - "https://vault.service.consul:8200/v1/pki_root/ca"
+crl_distribution_points:
+  - "https://vault.service.consul:8200/v1/pki_root/crl"
+ocsp_servers: []
+enable_templating: false
+default_issuer_ref: null
+default_follows_latest_issuer: false
+crl_expiry: "72h"
+crl_disable: false
+ocsp_disable: false
+auto_rebuild: false
+enable_delta: false
+delta_rebuild_interval: null

config/pki_secret_backend/pki/au/syd1.yaml

@@ -0,0 +1,18 @@
+description: "PKI Root CA AU SYD1"
+max_lease_ttl_seconds: 315360000  # 87600 * 3600
+common_name: "unkin.net AU SYD1 Root CA"
+issuer_name: "UNKIN_AU_SYD1_ROOTCA_2024"
+ttl: 315360000  # 87600 * 3600
+format: "pem"
+issuing_certificates:
+  - "https://vault.service.consul:8200/v1/pki/au/syd1/ca"
+crl_distribution_points:
+  - "https://vault.service.consul:8200/v1/pki/au/syd1/crl"
+ocsp_servers: []
+enable_templating: false
+default_follows_latest_issuer: false
+crl_expiry: "72h"
+crl_disable: false
+ocsp_disable: false
+auto_rebuild: false
+enable_delta: false