quorate/terraform/internal/vault/pki.tf

# Root CA
resource "vault_mount" "pki_root" {
  path                      = "pki"
  type                      = "pki"
  default_lease_ttl_seconds = 86400
  max_lease_ttl_seconds     = 3153600000 # 100 years
}

resource "vault_pki_secret_backend_root_cert" "root" {
  backend     = vault_mount.pki_root.path
  type        = "internal"
  common_name = "Internal Root CA"
  issuer_name = "internal-root"
  ttl         = "876000h" # 100 years
  key_type    = "ec"
  key_bits    = 384
}

resource "vault_pki_secret_backend_config_urls" "root" {
  backend                 = vault_mount.pki_root.path
  issuing_certificates    = ["https://vault.quorate.internal/v1/pki/ca"]
  crl_distribution_points = ["https://vault.quorate.internal/v1/pki/crl"]
}

# Intermediate CA
resource "vault_mount" "pki_int" {
  path                      = "pki_int"
  type                      = "pki"
  default_lease_ttl_seconds = 86400
  max_lease_ttl_seconds     = 157680000 # 5 years (intermediate lifetime)
}

resource "vault_pki_secret_backend_intermediate_cert_request" "int" {
  backend     = vault_mount.pki_int.path
  type        = "internal"
  common_name = "Internal Intermediate CA"
  key_type    = "ec"
  key_bits    = 256
}

resource "vault_pki_secret_backend_root_sign_intermediate" "int" {
  backend     = vault_mount.pki_root.path
  issuer_ref  = vault_pki_secret_backend_root_cert.root.issuer_id
  common_name = "Internal Intermediate CA"
  csr         = vault_pki_secret_backend_intermediate_cert_request.int.csr
  ttl         = "43800h" # 5 years
}

resource "vault_pki_secret_backend_intermediate_set_signed" "int" {
  backend     = vault_mount.pki_int.path
  certificate = vault_pki_secret_backend_root_sign_intermediate.int.certificate
}

resource "vault_pki_secret_backend_config_urls" "int" {
  backend                 = vault_mount.pki_int.path
  issuing_certificates    = ["https://vault.quorate.internal/v1/pki_int/ca"]
  crl_distribution_points = ["https://vault.quorate.internal/v1/pki_int/crl"]
}

# PKI role (on intermediate)
# cert-manager issues all Tier I leaf certificates through this role.
resource "vault_pki_secret_backend_role" "cert_manager" {
  backend            = vault_mount.pki_int.path
  name               = "cert-manager"
  issuer_ref         = "default"
  ttl                = 7776000 # 90 days
  max_ttl            = 7776000
  key_type           = "ec"
  key_bits           = 256
  allow_subdomains   = true
  allow_glob_domains = true
  allow_bare_domains = true
  allowed_domains = [
    var.internal_domain,
    var.cluster_domain,
    "svc.${var.cluster_domain}",
  ]
  require_cn = false
}

# Policy
resource "vault_policy" "cert_manager" {
  name = "cert-manager"

  policy = <<-EOT
    path "pki_int/sign/cert-manager" {
      capabilities = ["update"]
    }
  EOT
}

resource "vault_mount" "pki_opnsense" {
  path                      = "pki_opnsense"
  type                      = "pki"
  default_lease_ttl_seconds = 86400
  max_lease_ttl_seconds     = 3153600000
}

resource "vault_pki_secret_backend_root_cert" "opnsense" {
  backend     = vault_mount.pki_opnsense.path
  type        = "internal"
  common_name = "OPNsense Root CA"
  issuer_name = "opnsense-root"
  ttl         = "876000h"
  key_type    = "ec"
  key_bits    = 384
  permitted_ip_ranges = [
    "10.77.102.91/32",
    "10.212.111.120/32",
    "10.31.87.181/32",
    "10.86.169.153/32",
    "10.146.95.240/32",
  ]
}

resource "vault_pki_secret_backend_config_urls" "opnsense" {
  backend                 = vault_mount.pki_opnsense.path
  issuing_certificates    = ["https://vault.quorate.internal/v1/pki_opnsense/ca"]
  crl_distribution_points = ["https://vault.quorate.internal/v1/pki_opnsense/crl"]
}

resource "vault_pki_secret_backend_role" "opnsense" {
  backend             = vault_mount.pki_opnsense.path
  name                = "webgui"
  issuer_ref          = vault_pki_secret_backend_root_cert.opnsense.issuer_id
  ttl                 = 7776000
  max_ttl             = 7776000
  key_type            = "ec"
  key_bits            = 256
  allow_ip_sans       = true
  require_cn          = false
  use_csr_common_name = false
  use_csr_sans        = true
  server_flag         = true
  client_flag         = false
}

resource "vault_policy" "argo_opnsense_certificate" {
  name = "argo-opnsense-certificate"

  policy = <<-EOT
    path "pki_opnsense/sign/webgui" {
      capabilities = ["update"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "argo_opnsense_certificate" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "argo-opnsense-certificate"
  bound_service_account_names      = ["opnsense-certificate-rotator"]
  bound_service_account_namespaces = ["argo-opnsense-certificate"]
  token_policies                   = [vault_policy.argo_opnsense_certificate.name]
  token_ttl                        = 900
  token_max_ttl                    = 900
}

resource "vault_mount" "pki_postgres" {
  path                      = "pki_postgres"
  type                      = "pki"
  default_lease_ttl_seconds = 86400
  max_lease_ttl_seconds     = 3153600000
}

resource "vault_pki_secret_backend_root_cert" "postgres" {
  backend     = vault_mount.pki_postgres.path
  type        = "internal"
  common_name = "PostgreSQL Root CA"
  issuer_name = "postgres-root"
  ttl         = "876000h"
  key_type    = "ec"
  key_bits    = 384
}

resource "vault_pki_secret_backend_config_urls" "postgres" {
  backend                 = vault_mount.pki_postgres.path
  issuing_certificates    = ["https://vault.quorate.internal/v1/pki_postgres/ca"]
  crl_distribution_points = ["https://vault.quorate.internal/v1/pki_postgres/crl"]
}

resource "vault_pki_secret_backend_role" "postgres_server" {
  backend    = vault_mount.pki_postgres.path
  name       = "server"
  issuer_ref = vault_pki_secret_backend_root_cert.postgres.issuer_id
  ttl        = 7776000
  max_ttl    = 7776000
  key_type   = "ec"
  key_bits   = 256
  allowed_domains = [
    "main-rw",
    "main-rw.postgres",
    "main-rw.postgres.svc",
    "main-rw.postgres.svc.cluster.local",
    "main-rw-lb",
    "main-rw-lb.postgres",
    "main-rw-lb.postgres.svc",
    "main-rw-lb.postgres.svc.cluster.local",
    "main-ro-lb",
    "main-ro-lb.postgres",
    "main-ro-lb.postgres.svc",
    "main-ro-lb.postgres.svc.cluster.local",
    "postgres-rw.quorate.internal",
    "postgres-ro.quorate.internal",
  ]
  allow_bare_domains          = true
  allow_ip_sans               = false
  allow_localhost             = false
  allow_wildcard_certificates = false
  require_cn                  = false
  use_csr_common_name         = false
  use_csr_sans                = true
  server_flag                 = true
  client_flag                 = false
}

resource "vault_policy" "cert_manager_postgres" {
  name = "cert-manager-postgres"

  policy = <<-EOT
    path "pki_postgres/sign/server" {
      capabilities = ["update"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "cert_manager_postgres" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "cert-manager-postgres"
  bound_service_account_names      = ["cert-manager"]
  bound_service_account_namespaces = ["cert-manager"]
  token_policies                   = [vault_policy.cert_manager_postgres.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}