quorate/terraform/internal/vault/stalwart.tf

resource "random_password" "versitygw_stalwart_secret_access_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "versitygw_stalwart_user" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/stalwart"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = random_password.versitygw_stalwart_secret_access_key.result
  })
}

resource "random_password" "stalwart_dragonfly_password" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "dragonfly_stalwart_acl" {
  mount = vault_mount.secret.path
  name  = "dragonfly/stalwart/acl"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    acl = "user default on >${random_password.stalwart_dragonfly_password.result} ~* &* +@all\n"
  })
}

resource "random_password" "stalwart_recovery_admin" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "stalwart_runtime" {
  mount = vault_mount.secret.path
  name  = "stalwart/runtime"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    dragonfly_password = random_password.stalwart_dragonfly_password.result
    internal_ca_cert   = vault_pki_secret_backend_root_cert.root.certificate
    s3_secret_key      = random_password.versitygw_stalwart_secret_access_key.result
  })
}

resource "vault_kv_secret_v2" "stalwart_bootstrap" {
  mount = vault_mount.secret.path
  name  = "stalwart/bootstrap-credentials"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    username       = "********"
    password       = random_password.stalwart_recovery_admin.result
    recovery_admin = "********"
  })
}

resource "vault_kv_secret_v2" "stalwart_alert_identity" {
  mount                = vault_mount.secret.path
  name                 = "stalwart/alert-identity"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "stalwart_zitadel_notification" {
  mount = vault_mount.secret.path
  name  = "stalwart/zitadel-notification"

  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "stalwart_test_client" {
  mount                = vault_mount.secret.path
  name                 = "stalwart/test-client"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "stalwart_oci_email_delivery" {
  mount                = vault_mount.secret.path
  name                 = "stalwart/oci-email-delivery"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_policy" "stalwart" {
  name = "stalwart"

  policy = <<-EOT
    path "secret/data/stalwart/*" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
    path "database/static-creds/stalwart" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "stalwart" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "stalwart"
  bound_service_account_names      = ["stalwart"]
  bound_service_account_namespaces = ["stalwart"]
  token_policies                   = [vault_policy.stalwart.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}

resource "vault_policy" "stalwart_cred_writer" {
  name = "stalwart-cred-writer"

  policy = <<-EOT
    path "secret/data/stalwart/alert-identity" {
      capabilities = ["create", "read", "update"]
    }
    path "secret/data/stalwart/zitadel-notification" {
      capabilities = ["create", "read", "update"]
    }
    path "secret/data/stalwart/test-client" {
      capabilities = ["create", "read", "update"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "stalwart_cred_writer" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "stalwart-cred-writer"
  bound_service_account_names      = ["stalwart"]
  bound_service_account_namespaces = ["stalwart"]
  token_policies                   = [vault_policy.stalwart_cred_writer.name]
  token_ttl                        = 600
  token_max_ttl                    = 600
}