ce7cb702218693d08ea6d83464d2457c9250027c

scripts/tofu-pg-state

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export VAULT_ADDR=https://vault.quorate.internal
+
+state_host="${TF_STATE_PG_HOST:-10.234.158.153}"
+state_port="${TF_STATE_PG_PORT:-5432}"
+state_db="${TF_STATE_PG_DB:-tf_state}"
+state_vault_path="${TF_STATE_PG_VAULT_PATH:-database/static-creds/tf-state}"
+source_s3_key="${VERSITYGW_TERRAFORM_STATE_ACCESS_KEY_ID:-terraform-state}"
+source_s3_path="${VERSITYGW_TERRAFORM_STATE_VAULT_PATH:-secret/versitygw/users/terraform-state}"
+
+if [[ -z "${TF_CLI_CONFIG_FILE:-}" && -f dev.tfrc ]]; then
+  export TF_CLI_CONFIG_FILE=dev.tfrc
+fi
+
+tofu_subcommand=""
+for arg in "$@"; do
+  case "$arg" in
+    -chdir=*)
+      ;;
+    -*)
+      if [[ "$arg" == "-help" || "$arg" == "--help" || "$arg" == "-version" ]]; then
+        tofu_subcommand="$arg"
+        break
+      fi
+      ;;
+    *)
+      tofu_subcommand="$arg"
+      break
+      ;;
+  esac
+done
+
+needs_state_credentials=true
+needs_s3_credentials=false
+case "$tofu_subcommand" in
+  "" | "-help" | "--help" | "-version" | "version" | "fmt" | "validate" | "get" | "metadata")
+    needs_state_credentials=false
+    ;;
+  "init")
+    for arg in "$@"; do
+      if [[ "$arg" == "-backend=false" ]]; then
+        needs_state_credentials=false
+        break
+      fi
+      if [[ "$arg" == "-migrate-state" ]]; then
+        needs_s3_credentials=true
+      fi
+    done
+    ;;
+esac
+
+if [[ "$needs_state_credentials" == "false" ]]; then
+  exec tofu "$@"
+fi
+
+if ! command -v vault >/dev/null 2>&1; then
+  echo "vault CLI is required to read PostgreSQL Terraform state credentials" >&2
+  exit 1
+fi
+
+state_user="$(vault read -field=username "$state_vault_path")"
+state_password="$(vault read -field=password "$state_vault_path")"
+
+if [[ -z "$state_user" || -z "$state_password" ]]; then
+  echo "Vault credential $state_vault_path is incomplete" >&2
+  exit 1
+fi
+
+export PG_CONN_STR="postgres://${state_host}:${state_port}/${state_db}?sslmode=require"
+export PGUSER="$state_user"
+export PGPASSWORD="$state_password"
+
+if [[ "$needs_s3_credentials" == "true" ]]; then
+  source_s3_secret="$(vault kv get -field=secretAccessKey "$source_s3_path")"
+
+  if [[ -z "$source_s3_secret" ]]; then
+    echo "Vault credential $source_s3_path is incomplete" >&2
+    exit 1
+  fi
+
+  export AWS_ACCESS_KEY_ID="$source_s3_key"
+  export AWS_SECRET_ACCESS_KEY="$source_s3_secret"
+  export AWS_REGION="${AWS_REGION:-us-east-1}"
+  export AWS_EC2_METADATA_DISABLED=true
+fi
+
+exec tofu "$@"