unkin-agent
0e82cda02d
ci/woodpecker/push/apply Pipeline failed
## Why Creates the arrstack secrets engine itself: the mount + config and the per-scope roles that mint arrproxy API keys. **PR 3 of 3 (resources)**, stacked on #126 (policy). Final step of the register -> policy -> resources split (was #124). ## Change - Adds `config/arrstack_secret_backend/arrstack.yaml`: mounts the engine at `arrstack` and writes its config (`base_url`, timeout). The arrproxy admin token stays out of git and is read from KV by the module. - Adds `config/arrstack_secret_backend_role/arrstack/{all,sonarr,radarr,prowlarr}.yaml`: roles scoped to each arr app (plus one covering all three). Default `ttl` is **60s** (short-lived, renewed on demand); `max_ttl` 86400 mirrors the litellm sibling convention. The engine additionally caps renewal at the arrproxy admin token's fixed mint expiry. - Adds `modules/vault_cluster/modules/arrstack_secret_backend{,_role}` and wires them in: `config/config.hcl` maps, `modules/vault_cluster/main.tf`, `variables.tf`, the environment inputs, and the root provider block. - Provider source is `artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack` (repo `terraform-provider-vault-secrets-arrstack`), local name `arrstack`. ## Apply order Apply **after PR #126 (policy) AND after `terraform-provider-vault-secrets-arrstack` v0.1.0 is published** to the artifactapi terraform registry. Until the provider is published, `tofu init` cannot resolve it, so **CI/plan on this PR is red by design** — that is expected, not a regression. Note **plan-green != apply-green**: the KV-sourced `admin_token` is only fetched at apply time, so a green plan does not prove the seeded token is readable. ## Stack 1. register -> #125 2. policy -> #126 3. **resources (this PR)** -> `benvin/arrstack-resources` off `benvin/arrstack-policy` Supersedes #124. --------- Co-authored-by: unkin-agent <unkin-agent@git.unkin.net> Co-authored-by: BenVincent <benvin@main.unkin.net> Reviewed-on: #127 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
76 lines
2.0 KiB
HCL
76 lines
2.0 KiB
HCL
# Generate root backend.tf
|
|
generate "backend" {
|
|
path = "backend.tf"
|
|
if_exists = "overwrite"
|
|
contents = <<EOF
|
|
locals {
|
|
vault_addr = "https://vault.service.consul:8200"
|
|
}
|
|
|
|
provider "vault" {
|
|
address = local.vault_addr
|
|
}
|
|
|
|
# The LiteLLM secrets engine is managed through its own provider, which talks to
|
|
# the same Vault server. Token falls back to the VAULT_TOKEN environment variable.
|
|
provider "litellm" {
|
|
address = local.vault_addr
|
|
}
|
|
|
|
# The gpg secrets engine's keys are managed through its own provider (same Vault
|
|
# server; token falls back to VAULT_TOKEN).
|
|
provider "gpg" {
|
|
address = local.vault_addr
|
|
}
|
|
|
|
# The rancher token secrets engine is managed through its own provider (same
|
|
# Vault server; token falls back to VAULT_TOKEN).
|
|
provider "rancher" {
|
|
address = local.vault_addr
|
|
}
|
|
|
|
# The arrstack (arrproxy API key) secrets engine is managed through its own
|
|
# provider (same Vault server; token falls back to VAULT_TOKEN).
|
|
provider "arrstack" {
|
|
address = local.vault_addr
|
|
}
|
|
|
|
terraform {
|
|
backend "consul" {
|
|
address = "https://consul.service.consul"
|
|
path = "infra/terraform/vault/${path_relative_to_include()}/state"
|
|
scheme = "https"
|
|
lock = true
|
|
ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
|
|
}
|
|
required_version = ">= 1.10"
|
|
required_providers {
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "5.6.0"
|
|
}
|
|
consul = {
|
|
source = "hashicorp/consul"
|
|
version = "2.23.0"
|
|
}
|
|
litellm = {
|
|
source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
|
|
version = "0.1.0"
|
|
}
|
|
gpg = {
|
|
source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/gpgvaultsecret"
|
|
version = "0.1.0"
|
|
}
|
|
rancher = {
|
|
source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/ranchervaultsecret"
|
|
version = "0.1.0"
|
|
}
|
|
arrstack = {
|
|
source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
|
|
version = "0.1.0"
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
}
|