# Single declarative source for the terraform-infra NetBox service identity. The
# filename stem is the engine role name AND the NetBox username (1:1); config.hcl
# derives both from it, so neither is repeated below. Creating this file creates
# the user: the netbox_user_management module synthesizes the NetBox user + object
# permissions from the permissions block, and the engine role mints ephemeral
# tokens for that same user. write_enabled true because terraform-infra manages
# NetBox IPAM/DCIM; very short TTLs because a token is minted per plan/apply and
# revoked when the run's lease ends.
---
write_enabled: true
ttl: 120     # 2m
max_ttl: 300 # 5m
permissions:
  - object_types:
      - ipam.prefix
      - ipam.ipaddress
      - ipam.iprange
      - dcim.device
      - dcim.interface
      - dcim.macaddress
    actions:
      - view
      - add
      - change
      - delete