quorate/terraform/internal/vault/database.tf

data "terraform_remote_state" "postgres" {
  backend = "pg"
  config = {
    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
    schema_name = "internal_postgres"
  }
}

resource "vault_mount" "database" {
  path = "database"
  type = "database"
}

resource "vault_database_secret_backend_connection" "postgres" {
  backend       = vault_mount.database.path
  name          = "postgres"
  allowed_roles = ["zitadel", "forgejo", "forgejo-public", "grafana", "quay", "quay_clair", "argo", "stalwart", "tf-state", "hf-chat-ui"]

  postgresql {
    connection_url = "postgresql://{{username}}:{{password}}@main-rw.postgres.svc.cluster.local:5432/postgres?sslmode=require"
    username       = "********"
    password       = data.terraform_remote_state.postgres.outputs.vault_db_admin_password
  }
}

locals {
  db_static_rotation_schedule = "0 19 * * 0"
}

resource "vault_database_secret_backend_static_role" "zitadel" {
  backend           = vault_mount.database.path
  name              = "zitadel"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "forgejo" {
  backend           = vault_mount.database.path
  name              = "forgejo"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "forgejo_public" {
  backend           = vault_mount.database.path
  name              = "forgejo-public"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "grafana" {
  backend           = vault_mount.database.path
  name              = "grafana"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "quay" {
  backend           = vault_mount.database.path
  name              = "quay"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "quay_clair" {
  backend           = vault_mount.database.path
  name              = "quay_clair"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "argo" {
  backend           = vault_mount.database.path
  name              = "argo"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "stalwart" {
  backend           = vault_mount.database.path
  name              = "stalwart"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}

resource "vault_database_secret_backend_static_role" "tf_state" {
  backend           = vault_mount.database.path
  name              = "tf-state"
  db_name           = vault_database_secret_backend_connection.postgres.name
  username          = "********"
  rotation_schedule = local.db_static_rotation_schedule
}