259 lines
7.9 KiB
Terraform
259 lines
7.9 KiB
Terraform
|
variable "zitadel_org_name" {
|
||
|
|
description = "Name of the primary service organization to create in ZITADEL."
|
||
|
|
type = string
|
||
|
|
default = "Quorate"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "zitadel_org_id" {
|
||
|
|
description = "Optional stable custom ID for the primary service organization. Leave null to let ZITADEL generate one."
|
||
|
|
type = string
|
||
|
|
default = null
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "zitadel_project_name" {
|
||
|
|
description = "Name of the ZITADEL project that groups service clients."
|
||
|
|
type = string
|
||
|
|
default = "Services"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "forgejo_base_url" {
|
||
|
|
description = "Canonical Forgejo URL. This must match the Forgejo HTTPRoute hostname and ROOT_URL."
|
||
|
|
type = string
|
||
|
|
default = "https://forge.quorate.internal"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "forgejo_oauth_provider_name" {
|
||
|
|
description = "Forgejo OAuth2 authentication source name; this value is part of the callback URL."
|
||
|
|
type = string
|
||
|
|
default = "Zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "vault_kv_mount" {
|
||
|
|
description = "Vault KV v2 mount where generated service integration secrets are mirrored."
|
||
|
|
type = string
|
||
|
|
default = "secret"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "forgejo_oidc_vault_path" {
|
||
|
|
description = "Vault KV path for Forgejo's ZITADEL OIDC client material."
|
||
|
|
type = string
|
||
|
|
default = "forgejo/oidc/zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "stalwart_oidc_vault_path" {
|
||
|
|
description = "Vault KV path containing Stalwart's ZITADEL resource-server metadata."
|
||
|
|
type = string
|
||
|
|
default = "stalwart/oidc/zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "stalwart_zitadel_notification_vault_path" {
|
||
|
|
description = "Vault KV path containing Stalwart's ZITADEL notification SMTP credentials."
|
||
|
|
type = string
|
||
|
|
default = "stalwart/zitadel-notification"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "stalwart_project_name" {
|
||
|
|
description = "Name of the dedicated ZITADEL project for Stalwart tokens."
|
||
|
|
type = string
|
||
|
|
default = "Stalwart"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "stalwart_admin_zitadel_user_id" {
|
||
|
|
description = "ZITADEL human user ID granted Stalwart administrative access."
|
||
|
|
type = string
|
||
|
|
default = "********"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "forgejo_public_base_url" {
|
||
|
|
description = "Canonical authenticated URL for the public Forgejo database."
|
||
|
|
type = string
|
||
|
|
default = "https://git.quorate.dev"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "forgejo_public_oauth_provider_name" {
|
||
|
|
description = "Public Forgejo OAuth2 authentication source name."
|
||
|
|
type = string
|
||
|
|
default = "Zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "forgejo_public_oidc_vault_path" {
|
||
|
|
description = "Vault KV path for public Forgejo's ZITADEL OIDC client material."
|
||
|
|
type = string
|
||
|
|
default = "forgejo-public/oidc/zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "service_admin_zitadel_user_id" {
|
||
|
|
description = "ZITADEL human user ID granted administrative access to GitOps-managed service applications."
|
||
|
|
type = string
|
||
|
|
default = "********"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "service_admin_zitadel_role_keys" {
|
||
|
|
description = "Service project role keys assigned to service_admin_zitadel_user_id."
|
||
|
|
type = set(string)
|
||
|
|
default = [
|
||
|
|
"forgejo_admin",
|
||
|
|
"frigate_admin",
|
||
|
|
"grafana_admin",
|
||
|
|
"longhorn_admin",
|
||
|
|
"quay_admin",
|
||
|
|
]
|
||
|
|
|
||
|
|
validation {
|
||
|
|
condition = alltrue([
|
||
|
|
for role_key in var.service_admin_zitadel_role_keys : contains([
|
||
|
|
"forgejo_user",
|
||
|
|
"forgejo_admin",
|
||
|
|
"forgejo_restricted",
|
||
|
|
"frigate_viewer",
|
||
|
|
"frigate_admin",
|
||
|
|
"grafana_viewer",
|
||
|
|
"grafana_editor",
|
||
|
|
"grafana_admin",
|
||
|
|
"longhorn_admin",
|
||
|
|
"quay_user",
|
||
|
|
"quay_admin",
|
||
|
|
], role_key)
|
||
|
|
])
|
||
|
|
error_message = "Service admin ZITADEL grants may only use known Forgejo, Frigate, Grafana, Longhorn, and Quay role keys."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "frigate_base_url" {
|
||
|
|
description = "Canonical Frigate URL. This must match the Frigate HTTPRoute hostname and oauth2-proxy redirect URL."
|
||
|
|
type = string
|
||
|
|
default = "https://frigate.quorate.internal"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "frigate_zitadel_user_grants" {
|
||
|
|
description = "Map of ZITADEL user IDs to Frigate role keys to grant. Valid role keys are frigate_viewer and frigate_admin."
|
||
|
|
type = map(set(string))
|
||
|
|
default = {}
|
||
|
|
|
||
|
|
validation {
|
||
|
|
condition = alltrue(flatten([
|
||
|
|
for _, role_keys in var.frigate_zitadel_user_grants : [
|
||
|
|
for role_key in role_keys : contains([
|
||
|
|
"frigate_viewer",
|
||
|
|
"frigate_admin",
|
||
|
|
], role_key)
|
||
|
|
]
|
||
|
|
]))
|
||
|
|
error_message = "Frigate ZITADEL grants may only use frigate_viewer and frigate_admin."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "forgejo_zitadel_user_grants" {
|
||
|
|
description = "Map of ZITADEL user IDs to Forgejo role keys to grant. Valid role keys are forgejo_user, forgejo_admin, and forgejo_restricted."
|
||
|
|
type = map(set(string))
|
||
|
|
default = {}
|
||
|
|
|
||
|
|
validation {
|
||
|
|
condition = alltrue(flatten([
|
||
|
|
for _, role_keys in var.forgejo_zitadel_user_grants : [
|
||
|
|
for role_key in role_keys : contains([
|
||
|
|
"forgejo_user",
|
||
|
|
"forgejo_admin",
|
||
|
|
"forgejo_restricted",
|
||
|
|
], role_key)
|
||
|
|
]
|
||
|
|
]))
|
||
|
|
error_message = "Forgejo ZITADEL grants may only use forgejo_user, forgejo_admin, and forgejo_restricted."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "grafana_base_url" {
|
||
|
|
description = "Canonical Grafana URL. This must match the Grafana HTTPRoute hostname and root URL."
|
||
|
|
type = string
|
||
|
|
default = "https://grafana.quorate.internal"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "grafana_oidc_vault_path" {
|
||
|
|
description = "Vault KV path for Grafana's ZITADEL OIDC client material."
|
||
|
|
type = string
|
||
|
|
default = "grafana/oidc/zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "grafana_zitadel_user_grants" {
|
||
|
|
description = "Map of ZITADEL user IDs to Grafana role keys to grant. Valid role keys are grafana_viewer, grafana_editor, and grafana_admin."
|
||
|
|
type = map(set(string))
|
||
|
|
default = {}
|
||
|
|
|
||
|
|
validation {
|
||
|
|
condition = alltrue(flatten([
|
||
|
|
for _, role_keys in var.grafana_zitadel_user_grants : [
|
||
|
|
for role_key in role_keys : contains([
|
||
|
|
"grafana_viewer",
|
||
|
|
"grafana_editor",
|
||
|
|
"grafana_admin",
|
||
|
|
], role_key)
|
||
|
|
]
|
||
|
|
]))
|
||
|
|
error_message = "Grafana ZITADEL grants may only use grafana_viewer, grafana_editor, and grafana_admin."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "longhorn_base_url" {
|
||
|
|
description = "Canonical Longhorn URL. This must match the Longhorn HTTPRoute hostname and oauth2-proxy redirect URL."
|
||
|
|
type = string
|
||
|
|
default = "https://longhorn.quorate.internal"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "stalwart_account_webui_base_url" {
|
||
|
|
description = "Public Stalwart account WebUI base URL."
|
||
|
|
type = string
|
||
|
|
default = "https://mail.quorate.dev"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "longhorn_oauth2_proxy_vault_path" {
|
||
|
|
description = "Vault KV path for Longhorn's oauth2-proxy OIDC client material."
|
||
|
|
type = string
|
||
|
|
default = "longhorn/oauth2-proxy"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "longhorn_zitadel_user_grants" {
|
||
|
|
description = "Map of ZITADEL user IDs to Longhorn role keys to grant. Valid role key is longhorn_admin."
|
||
|
|
type = map(set(string))
|
||
|
|
default = {}
|
||
|
|
|
||
|
|
validation {
|
||
|
|
condition = alltrue(flatten([
|
||
|
|
for _, role_keys in var.longhorn_zitadel_user_grants : [
|
||
|
|
for role_key in role_keys : contains([
|
||
|
|
"longhorn_admin",
|
||
|
|
], role_key)
|
||
|
|
]
|
||
|
|
]))
|
||
|
|
error_message = "Longhorn ZITADEL grants may only use longhorn_admin."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "quay_base_url" {
|
||
|
|
description = "Canonical Quay URL. This must match the Quay HTTPRoute hostname and SERVER_HOSTNAME."
|
||
|
|
type = string
|
||
|
|
default = "https://registry.quorate.internal"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "quay_oidc_vault_path" {
|
||
|
|
description = "Vault KV path for Quay's ZITADEL OIDC client material."
|
||
|
|
type = string
|
||
|
|
default = "quay/oidc/zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
variable "quay_zitadel_user_grants" {
|
||
|
|
description = "Map of ZITADEL user IDs to Quay role keys to grant. Valid role keys are quay_user and quay_admin."
|
||
|
|
type = map(set(string))
|
||
|
|
default = {}
|
||
|
|
|
||
|
|
validation {
|
||
|
|
condition = alltrue(flatten([
|
||
|
|
for _, role_keys in var.quay_zitadel_user_grants : [
|
||
|
|
for role_key in role_keys : contains([
|
||
|
|
"quay_user",
|
||
|
|
"quay_admin",
|
||
|
|
], role_key)
|
||
|
|
]
|
||
|
|
]))
|
||
|
|
error_message = "Quay ZITADEL grants may only use quay_user and quay_admin."
|
||
|
|
}
|
||
|
|
}
|