ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

140
terraform/external/oci-relay/providers.tf vendored Normal file
View file

@ -0,0 +1,140 @@
terraform {
required_version = ">= 1.11.0, < 2.0.0"
backend "pg" {
conn_str = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
schema_name = "ext_oci_relay"
}
required_providers {
oci = {
source = "oracle/oci"
version = "~> 8.0"
}
vault = {
source = "hashicorp/vault"
version = "5.10.1"
}
}
}
provider "vault" {}
ephemeral "vault_kv_secret_v2" "operator_api" {
mount = "secret"
name = "oci/operator-api"
}
data "vault_generic_secret" "relay_config" {
path = "secret/oci/relay/tofu-config"
}
locals {
relay_config = data.vault_generic_secret.relay_config.data
tenancy_ocid = nonsensitive(local.relay_config["tenancy_ocid"])
region = nonsensitive(local.relay_config["region"])
budget_alert_recipients = local.relay_config["budget_alert_recipients"]
monitoring_alert_email = local.relay_config["budget_alert_recipients"]
home_wireguard_public_key = nonsensitive(local.relay_config["home_wireguard_public_key"])
relay_image_ocid = nonsensitive(local.relay_config["relay_image_ocid"])
publisher_api_public_key = local.relay_config["publisher_api_public_key"]
wan_controller_public_key = local.relay_config["wan_controller_api_public_key"]
publisher_email = local.relay_config["publisher_email"]
smtp_deny_publisher_api_public_key = try(local.relay_config["smtp_deny_publisher_api_public_key"], "")
smtp_deny_publisher_email = try(local.relay_config["smtp_deny_publisher_email"], "")
monitoring_alert_enabled = nonsensitive(local.monitoring_alert_email) != ""
publisher_enabled = nonsensitive(local.publisher_email) != ""
smtp_deny_publisher_enabled = var.mail_relay_enabled && nonsensitive(local.smtp_deny_publisher_email) != ""
home_tunnel_address = cidrhost(var.relay_tunnel_address, 2)
}
check "relay_vault_configuration" {
assert {
condition = can(regex("^ocid1\\.tenancy\\.", local.tenancy_ocid))
error_message = "The relay Vault configuration must contain an OCI tenancy OCID."
}
assert {
condition = can(regex("^[^@[:space:]]+@[^@[:space:]]+$", local.monitoring_alert_email))
error_message = "The relay Vault alert recipient must be one email address."
}
assert {
condition = can(regex("^-----BEGIN PUBLIC KEY-----", local.publisher_api_public_key))
error_message = "The relay Vault publisher public key must be PEM encoded."
}
assert {
condition = can(regex("^-----BEGIN PUBLIC KEY-----", local.wan_controller_public_key))
error_message = "The relay Vault WAN controller public key must be PEM encoded."
}
assert {
condition = can(regex("^[^@[:space:]]+@[^@[:space:]]+$", local.publisher_email))
error_message = "The relay Vault publisher email must be one email address."
}
assert {
condition = can(regex("^ocid1\\.image\\.", local.relay_image_ocid))
error_message = "The relay Vault configuration must contain a custom relay image OCID."
}
}
resource "terraform_data" "relay_configuration" {
input = {
imaps_health_check_enabled = var.imaps_health_check_enabled
imaps_ingress_source_cidrs = var.imaps_ingress_source_cidrs
mail_https_health_check_enabled = var.mail_https_health_check_enabled
mail_relay_enabled = var.mail_relay_enabled
smtp_health_check_enabled = var.smtp_health_check_enabled
smtp_ingress_source_cidrs = var.smtp_ingress_source_cidrs
smtp_deny_maximum_addresses = var.smtp_deny_maximum_addresses
smtp_deny_maximum_intervals = var.smtp_deny_maximum_intervals
smtp_deny_maximum_lifetime_seconds = var.smtp_deny_maximum_lifetime_seconds
smtp_deny_maximum_observation_window_seconds = var.smtp_deny_maximum_observation_window_seconds
smtp_deny_minimum_observations = var.smtp_deny_minimum_observations
smtp_evidence_snapshot_interval_seconds = var.smtp_evidence_snapshot_interval_seconds
relay_metrics_port = var.relay_metrics_port
submissions_health_check_enabled = var.submissions_health_check_enabled
submissions_ingress_source_cidrs = var.submissions_ingress_source_cidrs
web_allow_maximum_addresses = var.web_allow_maximum_addresses
web_allow_minimum_addresses = var.web_allow_minimum_addresses
web_allow_minimum_intervals = var.web_allow_minimum_intervals
}
lifecycle {
precondition {
condition = var.mail_relay_enabled || alltrue([
for source_cidrs in values(local.mail_ingress_source_cidrs_by_port) : length(source_cidrs) == 0
])
error_message = "Mail ingress sources cannot be admitted while relay guest mail forwarding is disabled."
}
precondition {
condition = var.mail_relay_enabled || !anytrue(concat(
values(local.mail_health_checks_by_port),
[var.mail_https_health_check_enabled]
))
error_message = "Mail health checks cannot be enabled while relay guest mail forwarding is disabled."
}
precondition {
condition = !var.mail_relay_enabled || can(regex("^-----BEGIN PUBLIC KEY-----", local.smtp_deny_publisher_api_public_key))
error_message = "The relay Vault SMTP deny publisher public key must be PEM encoded when mail relay is enabled."
}
precondition {
condition = !var.mail_relay_enabled || can(regex("^[^@[:space:]]+@[^@[:space:]]+$", local.smtp_deny_publisher_email))
error_message = "The relay Vault SMTP deny publisher email must be one email address when mail relay is enabled."
}
}
}
provider "oci" {
auth = "APIKey"
tenancy_ocid = ephemeral.vault_kv_secret_v2.operator_api.data["tenancy_ocid"]
user_ocid = ephemeral.vault_kv_secret_v2.operator_api.data["user_ocid"]
fingerprint = ephemeral.vault_kv_secret_v2.operator_api.data["fingerprint"]
private_key = ephemeral.vault_kv_secret_v2.operator_api.data["private_key"]
region = ephemeral.vault_kv_secret_v2.operator_api.data["region"]
}