ce7cb702218693d08ea6d83464d2457c9250027c

terraform/external/oci-relay/secrets.tf

@@ -0,0 +1,70 @@
+resource "oci_kms_vault" "relay" {
+  compartment_id = local.compartment_id
+  display_name   = "oci-l4-relay"
+  vault_type     = "DEFAULT"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_kms_key" "relay" {
+  compartment_id      = local.compartment_id
+  display_name        = "oci-l4-relay"
+  management_endpoint = oci_kms_vault.relay.management_endpoint
+  protection_mode     = "SOFTWARE"
+  freeform_tags       = var.freeform_tags
+
+  key_shape {
+    algorithm = "AES"
+    length    = 32
+  }
+}
+
+resource "oci_vault_secret" "wireguard_seed" {
+  compartment_id         = local.compartment_id
+  key_id                 = oci_kms_key.relay.id
+  secret_name            = "oci-l4-relay-wireguard-seed"
+  vault_id               = oci_kms_vault.relay.id
+  description            = "Seed material for the OCI relay WireGuard private key"
+  enable_auto_generation = true
+  freeform_tags          = var.freeform_tags
+
+  secret_generation_context {
+    generation_type     = "BYTES"
+    generation_template = "BYTES_512"
+  }
+}
+
+resource "oci_vault_secret" "wireguard_public_key" {
+  compartment_id = local.compartment_id
+  key_id         = oci_kms_key.relay.id
+  secret_name    = "oci-l4-relay-wireguard-public-key"
+  vault_id       = oci_kms_vault.relay.id
+  description    = "Published OCI relay WireGuard public key"
+  freeform_tags  = var.freeform_tags
+
+  secret_content {
+    content      = base64encode("pending")
+    content_type = "BASE64"
+  }
+
+  lifecycle {
+    ignore_changes = [secret_content]
+  }
+}
+
+resource "oci_vault_secret" "log_ingest" {
+  compartment_id = local.compartment_id
+  key_id         = oci_kms_key.relay.id
+  secret_name    = "oci-l4-relay-log-ingest"
+  vault_id       = oci_kms_vault.relay.id
+  description    = "Bearer credential for authenticated relay log ingestion"
+  freeform_tags  = var.freeform_tags
+
+  secret_content {
+    content      = base64encode("pending")
+    content_type = "BASE64"
+  }
+
+  lifecycle {
+    ignore_changes = [secret_content]
+  }
+}