41 lines
1.1 KiB
Terraform
41 lines
1.1 KiB
Terraform
|
resource "forgejo_organization" "gitops" {
|
||
|
|
name = var.organization_name
|
||
|
|
full_name = var.organization_full_name
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "forgejo_repository" "gitops" {
|
||
|
|
owner = forgejo_organization.gitops.name
|
||
|
|
name = var.repository_name
|
||
|
|
description = var.repository_description
|
||
|
|
private = true
|
||
|
|
auto_init = false
|
||
|
|
|
||
|
|
lifecycle {
|
||
|
|
prevent_destroy = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "tls_private_key" "flux_git" {
|
||
|
|
algorithm = "ED25519"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "forgejo_deploy_key" "flux_git" {
|
||
|
|
repository_id = forgejo_repository.gitops.id
|
||
|
|
title = var.flux_git_deploy_key_title
|
||
|
|
key = trimspace(tls_private_key.flux_git.public_key_openssh)
|
||
|
|
read_only = true
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "flux_git_ssh" {
|
||
|
|
mount = var.vault_kv_mount
|
||
|
|
name = var.flux_git_ssh_vault_path
|
||
|
|
|
||
|
|
data_json = jsonencode({
|
||
|
|
identity = tls_private_key.flux_git.private_key_pem
|
||
|
|
"identity.pub" = trimspace(tls_private_key.flux_git.public_key_openssh)
|
||
|
|
known_hosts = trimspace(var.flux_git_ssh_known_hosts)
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. Flux deploy key rotation is explicit.
|
||
|
|
lifecycle { ignore_changes = [data_json] }
|
||
|
|
}
|