unkinben
a960757ab2
Why: teabot's implementer and reviewer bot users should mint ephemeral, scoped Gitea tokens on demand instead of holding standing personal access tokens (Gitea tokens never expire on their own). This registers and mounts the new vault-plugin-secrets-gitea engine and declares its roles, mirroring the rancher engine wiring. Change: - Register the plugin in the catalog (config/plugins/vault-plugin-secrets-gitea.yaml) pinned to the released v0.1.0 binary sha256. - Add gitea_secret_backend + gitea_secret_backend_role modules and wire them through config.hcl, terragrunt.hcl, and vault_cluster variables/main, using the giteavaultsecret provider (terraform-unkin registry, v0.1.0). - Mount the engine at gitea/ against https://git.unkin.net; seeded site-admin credentials are read from KV (service/vault/au/syd1/secret_backend/gitea/config). - Add teabot-implementer (write:repository, write:issue) and teabot-reviewer (read:repository, write:issue) roles, ttl 1h / max_ttl 4h. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
91 lines
3.5 KiB
HCL
91 lines
3.5 KiB
HCL
include "root" {
|
|
path = find_in_parent_folders("root.hcl")
|
|
expose = true
|
|
}
|
|
|
|
include "config" {
|
|
path = "${get_repo_root()}/config/config.hcl"
|
|
expose = true
|
|
}
|
|
|
|
include "policies" {
|
|
path = "${get_repo_root()}/policies/policies.hcl"
|
|
expose = true
|
|
}
|
|
|
|
include "resources" {
|
|
path = "${get_repo_root()}/resources/resources.hcl"
|
|
expose = true
|
|
}
|
|
|
|
locals {
|
|
# Extract country and region from path
|
|
path_parts = split("/", dirname(get_terragrunt_dir()))
|
|
country = basename(dirname(get_terragrunt_dir())) # "au"
|
|
region = basename(get_terragrunt_dir()) # "syd1"
|
|
|
|
# Include configuration from config.hcl
|
|
config = include.config.locals.config
|
|
|
|
# Include policies from policies.hcl
|
|
policies = include.policies.locals
|
|
|
|
# Include resources from resources.hcl
|
|
resources = include.resources.locals
|
|
|
|
# Create sanitized backend name mapping for Consul providers
|
|
# Provider aliases can't contain slashes, so replace them with underscores
|
|
consul_backend_aliases = {
|
|
for backend_name, _ in local.config.consul_secret_backend :
|
|
backend_name => replace(backend_name, "/", "_")
|
|
}
|
|
}
|
|
|
|
terraform {
|
|
source = "../../../modules/vault_cluster"
|
|
}
|
|
|
|
inputs = {
|
|
country = local.country
|
|
region = local.region
|
|
|
|
# Pass configuration maps to vault_cluster module
|
|
auth_approle_backend = local.config.auth_approle_backend
|
|
auth_approle_role = local.config.auth_approle_role
|
|
auth_ldap_backend = local.config.auth_ldap_backend
|
|
auth_ldap_group = local.config.auth_ldap_group
|
|
auth_kubernetes_backend = local.config.auth_kubernetes_backend
|
|
auth_kubernetes_role = local.config.auth_kubernetes_role
|
|
kv_secret_backend = local.config.kv_secret_backend
|
|
transit_secret_backend = local.config.transit_secret_backend
|
|
transit_secret_backend_key = local.config.transit_secret_backend_key
|
|
ssh_secret_backend = local.config.ssh_secret_backend
|
|
ssh_secret_backend_role = local.config.ssh_secret_backend_role
|
|
pki_secret_backend = local.config.pki_secret_backend
|
|
pki_secret_backend_role = local.config.pki_secret_backend_role
|
|
consul_secret_backend = local.config.consul_secret_backend
|
|
consul_secret_backend_role = local.config.consul_secret_backend_role
|
|
kubernetes_secret_backend = local.config.kubernetes_secret_backend
|
|
kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
|
|
pki_mount_only = local.config.pki_mount_only
|
|
litellm_secret_backend = local.config.litellm_secret_backend
|
|
litellm_secret_backend_role = local.config.litellm_secret_backend_role
|
|
plugins = local.config.plugins
|
|
gpg_secret_backend = local.config.gpg_secret_backend
|
|
gpg_key = local.config.gpg_key
|
|
|
|
rancher_secret_backend = local.config.rancher_secret_backend
|
|
rancher_secret_backend_service_account = local.config.rancher_secret_backend_service_account
|
|
rancher_secret_backend_role = local.config.rancher_secret_backend_role
|
|
|
|
gitea_secret_backend = local.config.gitea_secret_backend
|
|
gitea_secret_backend_role = local.config.gitea_secret_backend_role
|
|
|
|
# Pass policy maps to vault_cluster module
|
|
policy_auth_map = local.policies.policy_auth_map
|
|
policy_rules_map = local.policies.policy_rules_map
|
|
|
|
# Pass sanitized consul backend aliases for provider configuration
|
|
consul_backend_aliases = local.consul_backend_aliases
|
|
}
|