70 lines
1.9 KiB
Terraform
70 lines
1.9 KiB
Terraform
|
resource "oci_kms_vault" "relay" {
|
||
|
|
compartment_id = local.compartment_id
|
||
|
|
display_name = "oci-l4-relay"
|
||
|
|
vault_type = "DEFAULT"
|
||
|
|
freeform_tags = var.freeform_tags
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_kms_key" "relay" {
|
||
|
|
compartment_id = local.compartment_id
|
||
|
|
display_name = "oci-l4-relay"
|
||
|
|
management_endpoint = oci_kms_vault.relay.management_endpoint
|
||
|
|
protection_mode = "SOFTWARE"
|
||
|
|
freeform_tags = var.freeform_tags
|
||
|
|
|
||
|
|
key_shape {
|
||
|
|
algorithm = "AES"
|
||
|
|
length = 32
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_vault_secret" "wireguard_seed" {
|
||
|
|
compartment_id = local.compartment_id
|
||
|
|
key_id = oci_kms_key.relay.id
|
||
|
|
secret_name = "oci-l4-relay-wireguard-seed"
|
||
|
|
vault_id = oci_kms_vault.relay.id
|
||
|
|
description = "Seed material for the OCI relay WireGuard private key"
|
||
|
|
enable_auto_generation = true
|
||
|
|
freeform_tags = var.freeform_tags
|
||
|
|
|
||
|
|
secret_generation_context {
|
||
|
|
generation_type = "BYTES"
|
||
|
|
generation_template = "BYTES_512"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_vault_secret" "wireguard_public_key" {
|
||
|
|
compartment_id = local.compartment_id
|
||
|
|
key_id = oci_kms_key.relay.id
|
||
|
|
secret_name = "oci-l4-relay-wireguard-public-key"
|
||
|
|
vault_id = oci_kms_vault.relay.id
|
||
|
|
description = "Published OCI relay WireGuard public key"
|
||
|
|
freeform_tags = var.freeform_tags
|
||
|
|
|
||
|
|
secret_content {
|
||
|
|
content = base64encode("pending")
|
||
|
|
content_type = "BASE64"
|
||
|
|
}
|
||
|
|
|
||
|
|
lifecycle {
|
||
|
|
ignore_changes = [secret_content]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_vault_secret" "log_ingest" {
|
||
|
|
compartment_id = local.compartment_id
|
||
|
|
key_id = oci_kms_key.relay.id
|
||
|
|
secret_name = "oci-l4-relay-log-ingest"
|
||
|
|
vault_id = oci_kms_vault.relay.id
|
||
|
|
description = "Bearer credential for authenticated relay log ingestion"
|
||
|
|
freeform_tags = var.freeform_tags
|
||
|
|
|
||
|
|
secret_content {
|
||
|
|
content = base64encode("pending")
|
||
|
|
content_type = "BASE64"
|
||
|
|
}
|
||
|
|
|
||
|
|
lifecycle {
|
||
|
|
ignore_changes = [secret_content]
|
||
|
|
}
|
||
|
|
}
|