quorate/terraform/internal/vault/project-delivery.tf

resource "vault_kv_secret_v2" "project_delivery_cache_reader" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/project-delivery-cache-reader"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = "PLACEHOLDER"
  })
}

resource "vault_kv_secret_v2" "rcon_publisher" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/rcon-publisher"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = "PLACEHOLDER"
  })
}

resource "vault_policy" "rcon_publisher" {
  name   = "rcon-publisher"
  policy = <<-EOT
    path "secret/data/versitygw/users/rcon-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "rcon_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "rcon-publisher"
  bound_service_account_names      = ["rcon-publisher-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.rcon_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kv_secret_v2" "project_delivery_cache_writer" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/project-delivery-cache-writer"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = "PLACEHOLDER"
  })
}

resource "vault_kv_secret_v2" "lazaret_publisher" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/lazaret-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "chultun_publisher" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/chultun-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "corago_publisher" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/corago-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "quorate_pull" {
  mount = vault_mount.secret.path
  name  = "forgejo/tokens/quorate-pull"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "quorate_push" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/quorate-push"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_policy" "chultun_publisher" {
  name = "chultun-publisher"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/chultun-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "chultun_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "chultun-publisher"
  bound_service_account_names      = ["chultun-pub-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.chultun_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_policy" "corago_publisher" {
  name = "corago-publisher"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/corago-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "corago_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "corago-publisher"
  bound_service_account_names      = ["corago-pub-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.corago_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kv_secret_v2" "zygostates_publisher" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/zygostates-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_policy" "zygostates_publisher" {
  name = "zygostates-publisher"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/zygostates-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "zygostates_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "zygostates-publisher"
  bound_service_account_names      = ["zygostates-pub-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.zygostates_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kv_secret_v2" "ostension_publisher" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/ostension-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_policy" "ostension_publisher" {
  name = "ostension-publisher"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/ostension-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "ostension_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "ostension-publisher"
  bound_service_account_names      = ["ostension-pub-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.ostension_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kv_secret_v2" "saltatory_publisher" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/saltatory-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_policy" "saltatory_publisher" {
  name = "saltatory-publisher"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/saltatory-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "saltatory_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "saltatory-publisher"
  bound_service_account_names      = ["saltatory-pub-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.saltatory_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_kv_secret_v2" "project_source" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/project-delivery-source"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_kv_secret_v2" "layshaft_publisher" {
  mount = vault_mount.secret.path
  name  = "forgejo-public/tokens/layshaft-publisher"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
}

resource "vault_policy" "layshaft_publisher" {
  name = "layshaft-publisher"

  policy = <<-EOT
    path "secret/data/forgejo-public/tokens/layshaft-publisher" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "layshaft_publisher" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "layshaft-publisher"
  bound_service_account_names      = ["layshaft-pub-vso"]
  bound_service_account_namespaces = ["project-delivery"]
  token_policies                   = [vault_policy.layshaft_publisher.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}