Ben Vincent
8070b6f66b
- migrate from individual terraform files to config-driven terragrunt module structure - add vault_cluster module with config discovery system - replace individual .tf files with centralized config.hcl - restructure auth and secret backends as configurable modules - move auth roles and secret backends to yaml-based configuration - convert policies from .hcl to .yaml format, add rules/auth definition - add pre-commit hooks for yaml formatting and file cleanup - add terragrunt cache to gitignore - update makefile with terragrunt commands and format target
45 lines
1.2 KiB
HCL
45 lines
1.2 KiB
HCL
# Generate root backend.tf
|
|
generate "backend" {
|
|
path = "backend.tf"
|
|
if_exists = "overwrite"
|
|
contents = <<EOF
|
|
#-------------------------------------------
|
|
# locals
|
|
#-------------------------------------------
|
|
locals {
|
|
vault_addr = "https://vault.service.consul:8200"
|
|
}
|
|
|
|
#-----------------------------------------------------------------------------
|
|
# Configure this provider through the environment variables:
|
|
# - VAULT_ADDR
|
|
# - VAULT_TOKEN
|
|
#-----------------------------------------------------------------------------
|
|
provider "vault" {
|
|
address = local.vault_addr
|
|
}
|
|
|
|
#------------------------------------------------------------------------------
|
|
# Use remote state file and encrypt it since your state files may contains
|
|
# sensitive data.
|
|
# export CONSUL_HTTP_TOKEN=<your-token>
|
|
#------------------------------------------------------------------------------
|
|
terraform {
|
|
backend "consul" {
|
|
address = "https://consul.service.consul"
|
|
path = "infra/terraform/vault/${path_relative_to_include()}/state"
|
|
scheme = "https"
|
|
lock = true
|
|
ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
|
|
}
|
|
required_version = ">= 1.10"
|
|
required_providers {
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "5.6.0"
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
}
|