quorate/terraform/internal/versitygw/artifacts.tf

ephemeral "vault_kv_secret_v2" "mc_publisher" {
  mount = "secret"
  name  = "versitygw/users/mc-publisher"
}

ephemeral "vault_kv_secret_v2" "minecraft" {
  mount = "secret"
  name  = "versitygw/users/minecraft"
}

ephemeral "vault_kv_secret_v2" "boot_publisher" {
  mount = "secret"
  name  = "versitygw/users/boot-publisher"
}

resource "versitygw_user" "boot_publisher" {
  access_key_id     = "********"
  secret_access_key = ephemeral.vault_kv_secret_v2.boot_publisher.data["secretAccessKey"]
  role              = "user"
}

resource "versitygw_user" "minecraft" {
  access_key_id     = "********"
  secret_access_key = ephemeral.vault_kv_secret_v2.minecraft.data["secretAccessKey"]
  role              = "user"
}

resource "versitygw_user" "mc_publisher" {
  access_key_id     = "********"
  secret_access_key = ephemeral.vault_kv_secret_v2.mc_publisher.data["secretAccessKey"]
  role              = "user"
}

ephemeral "vault_kv_secret_v2" "grafana" {
  mount = "secret"
  name  = "versitygw/users/grafana"
}

ephemeral "vault_kv_secret_v2" "model_reader" {
  mount = "secret"
  name  = "versitygw/users/model-reader"
}

resource "versitygw_user" "model_reader" {
  access_key_id     = "********"
  secret_access_key = ephemeral.vault_kv_secret_v2.model_reader.data["secretAccessKey"]
  role              = "user"
}

ephemeral "vault_kv_secret_v2" "rcon_publisher" {
  mount = "secret"
  name  = "versitygw/users/rcon-publisher"
}

resource "versitygw_user" "rcon_publisher" {
  access_key_id     = "********"
  secret_access_key = ephemeral.vault_kv_secret_v2.rcon_publisher.data["secretAccessKey"]
  role              = "user"
}

resource "versitygw_user" "grafana" {
  access_key_id     = "********"
  secret_access_key = ephemeral.vault_kv_secret_v2.grafana.data["secretAccessKey"]
  role              = "user"
}

resource "minio_s3_bucket" "artifacts" {
  bucket = "artifacts"
}

resource "minio_s3_bucket_policy" "artifacts" {
  bucket = minio_s3_bucket.artifacts.bucket

  depends_on = [versitygw_user.grafana, versitygw_user.rcon_publisher, versitygw_user.mc_publisher, versitygw_user.minecraft, versitygw_user.boot_publisher]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "MinecraftRead"
        Effect    = "Allow"
        Principal = "********"
        Action    = ["s3:GetObject"]
        Resource  = ["arn:aws:s3:::artifacts/minecraft/*"]
      },
      {
        Sid       = "SaltatoryRead"
        Effect    = "Allow"
        Principal = "********"
        Action    = ["s3:GetObject"]
        Resource  = ["arn:aws:s3:::artifacts/saltatory/*"]
      },
      {
        Sid       = "BootstrapPublish"
        Effect    = "Allow"
        Principal = "********"
        Action    = ["s3:GetObject", "s3:PutObject"]
        Resource  = ["arn:aws:s3:::artifacts/minecraft/*"]
      },
      {
        Sid       = "McPublish"
        Effect    = "Allow"
        Principal = "********"
        Action    = ["s3:GetObject", "s3:PutObject"]
        Resource  = ["arn:aws:s3:::artifacts/saltatory/*"]
      },
      {
        Sid       = "GrafanaPluginRead"
        Effect    = "Allow"
        Principal = "********"
        Action    = ["s3:GetObject"]
        Resource  = ["arn:aws:s3:::artifacts/grafana-rcon/*"]
      },
      {
        Sid       = "FrigateModelRead"
        Effect    = "Allow"
        Principal = versitygw_user.model_reader.access_key_id
        Action    = ["s3:GetObject"]
        Resource  = ["arn:aws:s3:::artifacts/frigate/yolov9-t-320.onnx"]
      },
      {
        Sid       = "RconPublish"
        Effect    = "Allow"
        Principal = "********"
        Action    = ["s3:GetObject", "s3:PutObject"]
        Resource  = ["arn:aws:s3:::artifacts/grafana-rcon/*"]
      },
    ]
  })
}