ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/forgejo/.terraform.lock.hcl

@@ -0,0 +1,86 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/tls" {
+  version     = "4.2.1"
+  constraints = "~> 4.0"
+  hashes = [
+    "h1:ALyauaoiauOEgiDjFt8gFHyvzs8JLBcHAEtIqDsE3Rg=",
+    "h1:ApZvTsHD9LJxRJiTlZnXCRTGQ92YUCDXUxNwaVbsQyQ=",
+    "h1:LFoLeANH42K6k4aH9zW+xN8pC0ls2flsbGeQTdEnABM=",
+    "h1:RZDD1y8qrxf7+gdnfFcGP0G6GDe/kv4zNDNdg1HpuSQ=",
+    "h1:Vr77TEfxpe/RLNWDDGI1Wz3rDFN1M3dLNMFSk4DKAAo=",
+    "h1:ZT6bZoEZh729x6ax/Xe5eEcBbXZ5HGv2i7ijIh5k74I=",
+    "h1:ZilRQg3gaNxvWpwnrjV3ZyU4dXI0yQfgsxu2swX9E14=",
+    "h1:p+7dQZVz/XpgVLmH00WLFAxDiSWlo/+LXFft0qM4aLg=",
+    "h1:vjihqyZJK3CyXKYpKn4KjqeUBiLCDi26DNgVpzfMm+Y=",
+    "zh:0435b85c1aa6ac9892e88d99eaae0b1712764b236bf469c114c6ff4377b113d6",
+    "zh:3413d6c61a6a1db2466200832e1d86b2992b81866683b1b946e7e25d99e8daf9",
+    "zh:4e7610d4c05fee00994b851bc5ade704ae103d56f28b84dedae7ccab2148cc3f",
+    "zh:5d7d29342992c202f748ff72dcaa1fa483d692855e57b87b743162eaf12b729a",
+    "zh:7db84d143330fcc1f6f2e79b9c7cc74fdb4ddfe78d10318d060723d6affb8a5c",
+    "zh:b7fb825fd0eccf0ea9afb46627d2ec217d2d99a5532de8bcbdfaa0992d0248e2",
+    "zh:cb8ca2de5f7367d987a23f88c76d80480bcc49da8bdc3fd24dd9b19d3428d72d",
+    "zh:eb88588123dd53175463856d4e2323fb0da44bdcf710ec34f2cad6737475638b",
+    "zh:f92baceb82d3a1e5b6a34a29c605b54cae8c6b09ea1fffb0af4d036337036a8f",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/vault" {
+  version     = "5.8.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:/OZCcd0X7F9y846SOlVUMItMtLDBwasYe+Mv3HF2I1Q=",
+    "h1:68t9TdU3ap9L+Ayewb478BIyv8rpEDIQxYq1xsq99fs=",
+    "h1:6MmwOTMo0TpjoMs27LNKfxD+kZypRclB2WrV1OgbWD4=",
+    "h1:8DpFTiNTio1Yal+kozfxkPabRvN8ucRyjVkRcKuCnCo=",
+    "h1:B1DuZ215BVQbK/70wahsWR6Wy16LMicdRCuThNgeBOg=",
+    "h1:EhuYG2XYdV7d3RuOB/r/KKv0k5XXtDoBMgrzPraH8yQ=",
+    "h1:FIRP0mpZpyDppetTZxzmaH2kd2E0o8As9w2CANYsEhE=",
+    "h1:KuT1QZ3kyjqZ/YENs5ABfhSHEBLr/01ZWzWbJrS+vDo=",
+    "h1:SMqA7BA2Nv/R4O8oVi8arc1E2NXz56dcnp54vFG9sfg=",
+    "h1:TO99KdU92KULAbT4D0CJSeGFLuEsOgR10d6qFnR3dDk=",
+    "h1:Y3HaoTjTuH4UePPja1vDrRxrSTNhR7wq//qJsJA7/rQ=",
+    "h1:bd5YeFG+ok71bEUWdvksBLPWBWVpeosSl0rbbDJAigE=",
+    "h1:eSjvykpglWlaCF/77dluIgXQ/SbPlh7RSSuLjAYNZUs=",
+    "h1:lUnHYFRPEO+C+DwumShhX7va0iY9ApkhoSSj/P7vCsk=",
+    "h1:qFAesj3MEaAzGFL2tvV+uy/biNwGJUculuN5CFtTh1E=",
+    "zh:1c9d0b740520a88a16ccc57c6bcb1a58e47b6ba19676428b2a0f5b9fe4004788",
+    "zh:274ad5bad107a845927773a6a31a45cd0ed7916fa52b86d85c86c535b59fcea4",
+    "zh:2b2eef2cb6840c3cf41134b1d1b6d3d50d6edbe3b2af2318bf7101843072c83b",
+    "zh:42b607a2983e77a47099b5ac8550a25ecd5ba03760be19749a4ad63617ea6085",
+    "zh:544877ac091e54b2954f5638edf06d76f344eb6833fb68db961c0edb5b0fdc83",
+    "zh:812bd7730efb3781fcfc7442650551d30b015f931a132ae9acdffdd625526908",
+    "zh:8798d164f8e25f3b211be45e79d3bd5272e9237e728942c0026300b25798e5fe",
+    "zh:91201a2e5dbc88013977960f0d1139fb584cdcda1cfd27577980d8cf0a31ead3",
+    "zh:a532662249b28e10a065bbab467d4ea9a12719638fe0f7e0add05d8d11142366",
+    "zh:ab91b32cbcc71cd9e89cca7d88957d9410f54750f7ea60f1416d2d77b478006a",
+    "zh:ae5658b04277318c8b91c0a9ed2ec05dd324a7501c1a057d53e79b0e1978a1f6",
+    "zh:e02581fca392f46738a95999d5fbccca7d82500df3a88e16ae9668633eb16f9b",
+    "zh:e89f59329ee939b59158c6173484ef4376da44296f6153d2fbafd3e28bd650c5",
+    "zh:e9ac49b94293cb5c8b31eb6e5afddc6134ffff0481ec195b242e0175e1f6766f",
+    "zh:ef60d5715c3b82ae64643dea9b4c1a82c10f72151c77af2749d3ceb060bb2adb",
+  ]
+}
+
+provider "registry.terraform.io/svalabs/forgejo" {
+  version     = "1.4.2"
+  constraints = "~> 1.4"
+  hashes = [
+    "h1:jA2BQVOpldQcMGUhAkfAYDmjOQMkAoWhZASq14nmaFc=",
+    "zh:034b4198ced58db8a074594fadcf72b8243b732187626cb764927b68e445f3c1",
+    "zh:2079e988b4e7f0186778abced584ac81e1a532f7b2df223ac14598349a66b59f",
+    "zh:21bd45803273c9a07ea41c931686c1e15a1352bc18be64b4315c6b4847223f41",
+    "zh:54616de04c965686907a07811c511a4fc8162b4bbffb65d5d4e275df1e6ed638",
+    "zh:7c94b88ef097e4a782e3105719d1a432a3ece217c3cce18873f29c840afa3694",
+    "zh:85dfb48cf20e985d435bc6b11052d65ccdff7e5813e582b51a9032b5deed0dcf",
+    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
+    "zh:9d68424deb0bcfb691560c0ed01e2962c0973df699b518f70eea1e077d72a23d",
+    "zh:ac9963f135f11fa44102388b97c3c606f8e0d01967b16fbb35d79c283a38b174",
+    "zh:c16e33623ea8227d478099c66ce7acbcea40107da19c8bc35dc2d367d2e42a3f",
+    "zh:c29abe5772481b2b9ca86ff73c856a2ef6ea03d121948b802c1f17ab6c7c2a70",
+    "zh:dbac630f62f3f00f6dfa8beb620ebe9b018512161197bc3a8f5003998bff48d4",
+    "zh:e33b275e8ab2f6eb46c27e82e72a305a9488e2e8e092583c2ecd59f5ab604b5b",
+    "zh:e67b5136334dc87ee85bd082386a382620ba816a9d4cbee21965faca2227d15c",
+  ]
+}

terraform/internal/forgejo/main.tf

@@ -0,0 +1,41 @@
+resource "forgejo_organization" "gitops" {
+  name      = var.organization_name
+  full_name = var.organization_full_name
+}
+
+resource "forgejo_repository" "gitops" {
+  owner       = forgejo_organization.gitops.name
+  name        = var.repository_name
+  description = var.repository_description
+  private     = true
+  auto_init   = false
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "tls_private_key" "flux_git" {
+  algorithm = "ED25519"
+}
+
+resource "forgejo_deploy_key" "flux_git" {
+  repository_id = forgejo_repository.gitops.id
+  title         = var.flux_git_deploy_key_title
+  key           = trimspace(tls_private_key.flux_git.public_key_openssh)
+  read_only     = true
+}
+
+resource "vault_kv_secret_v2" "flux_git_ssh" {
+  mount = var.vault_kv_mount
+  name  = var.flux_git_ssh_vault_path
+
+  data_json = jsonencode({
+    identity       = tls_private_key.flux_git.private_key_pem
+    "identity.pub" = trimspace(tls_private_key.flux_git.public_key_openssh)
+    known_hosts    = trimspace(var.flux_git_ssh_known_hosts)
+  })
+
+  # Vault is source of truth after first write. Flux deploy key rotation is explicit.
+  lifecycle { ignore_changes = [data_json] }
+}

terraform/internal/forgejo/outputs.tf

@@ -0,0 +1,14 @@
+output "repository_full_name" {
+  description = "Forgejo owner/repository path."
+  value       = "${forgejo_organization.gitops.name}/${forgejo_repository.gitops.name}"
+}
+
+output "repository_in_cluster_ssh_url" {
+  description = "In-cluster Git-over-SSH URL for FluxInstance sync."
+  value       = "ssh://[email protected]/${forgejo_organization.gitops.name}/${forgejo_repository.gitops.name}.git"
+}
+
+output "flux_git_ssh_vault_path" {
+  description = "Vault KV path synced by VSO into flux-system/git-ssh-auth."
+  value       = "${var.vault_kv_mount}/${var.flux_git_ssh_vault_path}"
+}

terraform/internal/forgejo/providers.tf

@@ -0,0 +1,38 @@
+terraform {
+  required_version = "< 2.0.0"
+  backend "pg" {
+    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
+    schema_name = "internal_forgejo"
+  }
+
+  required_providers {
+    forgejo = {
+      source  = "registry.terraform.io/svalabs/forgejo"
+      version = "~> 1.4"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "vault" {}
+
+ephemeral "vault_kv_secret_v2" "forgejo_admin" {
+  mount = var.vault_kv_mount
+  name  = var.forgejo_admin_vault_path
+}
+
+locals {
+  forgejo_admin_api_token = ephemeral.vault_kv_secret_v2.forgejo_admin.data[var.forgejo_admin_api_token_key]
+}
+
+provider "forgejo" {
+  host      = var.forgejo_host
+  api_token = local.forgejo_admin_api_token
+}

terraform/internal/forgejo/variables.tf

@@ -0,0 +1,70 @@
+variable "forgejo_host" {
+  description = "Forgejo base URL used by Terraform to manage Forgejo resources."
+  type        = string
+  default     = "https://forge.quorate.internal"
+}
+
+variable "organization_name" {
+  description = "Forgejo organization that owns the GitOps repository."
+  type        = string
+  default     = "quorate"
+}
+
+variable "organization_full_name" {
+  description = "Display name for the Forgejo organization."
+  type        = string
+  default     = "Quorate"
+}
+
+variable "repository_name" {
+  description = "Forgejo repository name used as Flux's Git source."
+  type        = string
+  default     = "cluster"
+}
+
+variable "repository_description" {
+  description = "Description for the Flux GitOps repository."
+  type        = string
+  default     = "Declarative cluster state."
+}
+
+variable "repository_default_branch" {
+  description = "Default branch for the Flux GitOps repository."
+  type        = string
+  default     = "master"
+}
+
+variable "flux_git_deploy_key_title" {
+  description = "Title of the Forgejo deploy key Flux uses for Git-over-SSH."
+  type        = string
+  default     = "flux-system"
+}
+
+variable "flux_git_ssh_known_hosts" {
+  description = "SSH known_hosts entries Flux should trust for the Forgejo SSH endpoint."
+  type        = string
+}
+
+variable "vault_kv_mount" {
+  description = "Vault KV v2 mount where the Flux Git deploy key is mirrored."
+  type        = string
+  default     = "secret"
+}
+
+variable "forgejo_admin_vault_path" {
+  description = "Vault KV path containing the Forgejo admin API token used by Terraform."
+  type        = string
+  default     = "forgejo/terraform-admin"
+}
+
+variable "forgejo_admin_api_token_key" {
+  description = "Key in forgejo_admin_vault_path containing the Forgejo API token."
+  type        = string
+  default     = "apiToken"
+}
+
+variable "flux_git_ssh_vault_path" {
+  description = "Vault KV path for the Flux Git-over-SSH credential."
+  type        = string
+  default     = "flux/forgejo/git-ssh"
+}

terraform/internal/postgres/.terraform.lock.hcl

@@ -0,0 +1,99 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/cyrilgdn/postgresql" {
+  version     = "1.26.0"
+  constraints = "~> 1.26"
+  hashes = [
+    "h1:7RvWsnQOenYEBG8qA0nQtrsz32FEhS9RXAS40ncOx80=",
+    "h1:8bXFg6KkLzUAd44WUnqSxVY0pqXALT14h59OlYq3UTY=",
+    "h1:D4Q68dTDZHAeGeJDR4p1ilmxS9bVm4B9eDsY3Omjn/E=",
+    "h1:DsAiYnizf3W62ERIfshpIDhzMIqgLQvwwCun3Uuu1Cs=",
+    "h1:EQH2pCkaR0vf3OyzyEr/SdYTg6JCrgSV1WYxkRYCUtc=",
+    "h1:FaTc/yPD5/Fp4Mchju/bIvRJAuCikrrH4pRMoUZKs2k=",
+    "h1:MKR/hM2mwly5/lv+8j06B7BqPz8RUcFvvTZn2BZqWGM=",
+    "h1:OmjWcf08BwORkQ+VpOw1qlh2LE4ZR/huj9KZt2IRHsQ=",
+    "h1:RBYmB7ASNzcKarvfqSGw260ZKd+m5Dxbp5SKcSWyc0Q=",
+    "h1:VAxyMQCSN17laQb0YW98bbo3p6MvgdJOkN20gkDEWF0=",
+    "h1:WEFcXvxxzMtbumRdCSYLd+iVQmgWkNZHos7KcXXL7k8=",
+    "h1:YmlWzleORO+YHWjcQuNgFG9rJbL70QErM6QHXz2YDeQ=",
+    "h1:aY3oidJAUFs53Rmpa2L2uC+8f1ZdEbS9k7LZ7d4s3Gk=",
+    "h1:kId855uQr126ruzaPg2KA5EZ+j2fwASTZOK4QplxyBY=",
+    "zh:0f2ec2bb24f8bb9eb232f1650d6459a2bac732bf91bbc08b27ae5519bee89486",
+    "zh:11dafcec9c7e6e2c8b6303d90c6061973db26f6f84adc2be02fe66e9b1b11561",
+    "zh:13a67dc639ee053cbecc6ab28fd5bfca4780e680bd12491f1bdf0f8243fd364a",
+    "zh:56337a42348bb9ab31837caa89d89f7a3ee0528b5a6d04a6a93a8ea155eb7f4d",
+    "zh:590e80218e70e8081a11cf1f5df16014426d6ba8c2552713cc61f56041c7457b",
+    "zh:5e4b12dd1874bab454720a50c600d1df359dc71f91f4a0194cf8eb335e27dfe7",
+    "zh:6af55f892e7f463c75a62215dc74790ae9a71d7d23c74c6ddb40af258528fa46",
+    "zh:78f6739ca865622981c28fa6628128be4651bd4629450a9ba5b1945d64b66da7",
+    "zh:8ed469b0d9074eba59216e57794a03fe27b45586b03d24946d130949ae92093f",
+    "zh:a261aaee5675986711cf9f963d5d9ca5ec1d62aa8c31866da54c6670d803b8a3",
+    "zh:a64b52597738ff1bac41127141c48800f1575eaa66a67cecdc9b0b16728dae0e",
+    "zh:ae5e821f5d5510bc2cba2aefcf6c0e62af9e28b7a25e0e8dcd039e04172594d0",
+    "zh:cfae79ed700febe8fb29fd1c5d0a6ace0a0103bef8ec37bb653dc23afc960b33",
+    "zh:d9a69d5475982a00d4e9e07f56987c821782595bac29e9084237285d36fa88e8",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/random" {
+  version     = "3.8.1"
+  constraints = "~> 3.8"
+  hashes = [
+    "h1:4XzXwVRt9H0n4AZt0fpNc0AuBIsZH2MF6enFO0Tgm/E=",
+    "h1:EHn3jsqOKhWjbg0X+psk0Ww96yz3N7ASqEKKuFvDFwo=",
+    "h1:HTRqTUdrtlIPsvneQRTTGUfU46vHJ0uI7lf26SNVSoo=",
+    "h1:K/OIbLGX0YNiuoDXlpkerSWyv+bjS97Z6YGUCGePPAw=",
+    "h1:LsYuJLZcYl1RiH7Hd3w90Ra5+k5cNqfdRUQXItkTI8Y=",
+    "h1:ZmWv79WB2oB8IuUyTylbl9zEeWyJVvjd0Uac+Lk6LVw=",
+    "h1:bXd92D1e8ahgUbZNQPoOe+VK+WfNRMP8wU3meagUtB4=",
+    "h1:nz02g0rqNAJ+KO1Lq5Krfp3qJCuhA4bJuV8jtUw99ss=",
+    "h1:tZP70yQDl6mKnTsDtx6tS6GReVb1lgb7WnlIIneXsHY=",
+    "zh:25c458c7c676f15705e872202dad7dcd0982e4a48e7ea1800afa5fc64e77f4c8",
+    "zh:2edeaf6f1b20435b2f81855ad98a2e70956d473be9e52a5fdf57ccd0098ba476",
+    "zh:44becb9d5f75d55e36dfed0c5beabaf4c92e0a2bc61a3814d698271c646d48e7",
+    "zh:7699032612c3b16cc69928add8973de47b10ce81b1141f30644a0e8a895b5cd3",
+    "zh:86d07aa98d17703de9fbf402c89590dc1e01dbe5671dd6bc5e487eb8fe87eee0",
+    "zh:8c411c77b8390a49a8a1bc9f176529e6b32369dd33a723606c8533e5ca4d68c1",
+    "zh:a5ecc8255a612652a56b28149994985e2c4dc046e5d34d416d47fa7767f5c28f",
+    "zh:aea3fe1a5669b932eda9c5c72e5f327db8da707fe514aaca0d0ef60cb24892f9",
+    "zh:f56e26e6977f755d7ae56fa6320af96ecf4bb09580d47cb481efbf27f1c5afff",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/vault" {
+  version     = "5.8.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:/OZCcd0X7F9y846SOlVUMItMtLDBwasYe+Mv3HF2I1Q=",
+    "h1:68t9TdU3ap9L+Ayewb478BIyv8rpEDIQxYq1xsq99fs=",
+    "h1:6MmwOTMo0TpjoMs27LNKfxD+kZypRclB2WrV1OgbWD4=",
+    "h1:8DpFTiNTio1Yal+kozfxkPabRvN8ucRyjVkRcKuCnCo=",
+    "h1:B1DuZ215BVQbK/70wahsWR6Wy16LMicdRCuThNgeBOg=",
+    "h1:EhuYG2XYdV7d3RuOB/r/KKv0k5XXtDoBMgrzPraH8yQ=",
+    "h1:FIRP0mpZpyDppetTZxzmaH2kd2E0o8As9w2CANYsEhE=",
+    "h1:KuT1QZ3kyjqZ/YENs5ABfhSHEBLr/01ZWzWbJrS+vDo=",
+    "h1:SMqA7BA2Nv/R4O8oVi8arc1E2NXz56dcnp54vFG9sfg=",
+    "h1:TO99KdU92KULAbT4D0CJSeGFLuEsOgR10d6qFnR3dDk=",
+    "h1:Y3HaoTjTuH4UePPja1vDrRxrSTNhR7wq//qJsJA7/rQ=",
+    "h1:bd5YeFG+ok71bEUWdvksBLPWBWVpeosSl0rbbDJAigE=",
+    "h1:eSjvykpglWlaCF/77dluIgXQ/SbPlh7RSSuLjAYNZUs=",
+    "h1:lUnHYFRPEO+C+DwumShhX7va0iY9ApkhoSSj/P7vCsk=",
+    "h1:qFAesj3MEaAzGFL2tvV+uy/biNwGJUculuN5CFtTh1E=",
+    "zh:1c9d0b740520a88a16ccc57c6bcb1a58e47b6ba19676428b2a0f5b9fe4004788",
+    "zh:274ad5bad107a845927773a6a31a45cd0ed7916fa52b86d85c86c535b59fcea4",
+    "zh:2b2eef2cb6840c3cf41134b1d1b6d3d50d6edbe3b2af2318bf7101843072c83b",
+    "zh:42b607a2983e77a47099b5ac8550a25ecd5ba03760be19749a4ad63617ea6085",
+    "zh:544877ac091e54b2954f5638edf06d76f344eb6833fb68db961c0edb5b0fdc83",
+    "zh:812bd7730efb3781fcfc7442650551d30b015f931a132ae9acdffdd625526908",
+    "zh:8798d164f8e25f3b211be45e79d3bd5272e9237e728942c0026300b25798e5fe",
+    "zh:91201a2e5dbc88013977960f0d1139fb584cdcda1cfd27577980d8cf0a31ead3",
+    "zh:a532662249b28e10a065bbab467d4ea9a12719638fe0f7e0add05d8d11142366",
+    "zh:ab91b32cbcc71cd9e89cca7d88957d9410f54750f7ea60f1416d2d77b478006a",
+    "zh:ae5658b04277318c8b91c0a9ed2ec05dd324a7501c1a057d53e79b0e1978a1f6",
+    "zh:e02581fca392f46738a95999d5fbccca7d82500df3a88e16ae9668633eb16f9b",
+    "zh:e89f59329ee939b59158c6173484ef4376da44296f6153d2fbafd3e28bd650c5",
+    "zh:e9ac49b94293cb5c8b31eb6e5afddc6134ffff0481ec195b242e0175e1f6766f",
+    "zh:ef60d5715c3b82ae64643dea9b4c1a82c10f72151c77af2749d3ceb060bb2adb",
+  ]
+}

terraform/internal/postgres/argo.tf

@@ -0,0 +1,26 @@
+resource "random_password" "argo" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "argo" {
+  name     = "argo"
+  login    = true
+  password = random_password.argo.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "argo" {
+  name  = "argo"
+  owner = postgresql_role.argo.name
+}
+
+# Allows vault_db_admin to ALTER ROLE argo PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_argo" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.argo.name
+  with_admin_option = true
+}

terraform/internal/postgres/forgejo-public.tf

@@ -0,0 +1,25 @@
+resource "random_password" "forgejo_public" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "forgejo_public" {
+  name     = "forgejo_public"
+  login    = true
+  password = random_password.forgejo_public.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "forgejo_public" {
+  name  = "forgejo_public"
+  owner = postgresql_role.forgejo_public.name
+}
+
+resource "postgresql_grant_role" "vault_db_admin_forgejo_public" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.forgejo_public.name
+  with_admin_option = true
+}

terraform/internal/postgres/forgejo.tf

@@ -0,0 +1,26 @@
+resource "random_password" "forgejo" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "forgejo" {
+  name     = "forgejo"
+  login    = true
+  password = random_password.forgejo.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "forgejo" {
+  name  = "forgejo"
+  owner = postgresql_role.forgejo.name
+}
+
+# Allows vault_db_admin to ALTER ROLE forgejo PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_forgejo" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.forgejo.name
+  with_admin_option = true
+}

terraform/internal/postgres/grafana.tf

@@ -0,0 +1,26 @@
+resource "random_password" "grafana" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "grafana" {
+  name     = "grafana"
+  login    = true
+  password = random_password.grafana.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "grafana" {
+  name  = "grafana"
+  owner = postgresql_role.grafana.name
+}
+
+# Allows vault_db_admin to ALTER ROLE grafana PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_grafana" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.grafana.name
+  with_admin_option = true
+}

terraform/internal/postgres/hf-chat-ui.tf

@@ -0,0 +1,25 @@
+resource "random_password" "hf_chat_ui" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "hf_chat_ui" {
+  name     = "hf_chat_ui"
+  login    = true
+  password = random_password.hf_chat_ui.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "hf_chat_ui" {
+  name  = "hf_chat_ui"
+  owner = postgresql_role.hf_chat_ui.name
+}
+
+resource "postgresql_grant_role" "hf_rotation" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.hf_chat_ui.name
+  with_admin_option = true
+}

terraform/internal/postgres/providers.tf

@@ -0,0 +1,73 @@
+terraform {
+  required_version = "< 2.0.0"
+  backend "pg" {
+    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
+    schema_name = "internal_postgres"
+  }
+
+  required_providers {
+    postgresql = {
+      source  = "cyrilgdn/postgresql"
+      version = "~> 1.26"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.8"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "vault" {}
+
+ephemeral "vault_kv_secret_v2" "postgres_admin" {
+  mount = var.vault_kv_mount
+  name  = var.postgres_admin_vault_path
+}
+
+locals {
+  postgres_admin_user     = ephemeral.vault_kv_secret_v2.postgres_admin.data[var.postgres_admin_user_key]
+  postgres_admin_password = ephemeral.vault_kv_secret_v2.postgres_admin.data[var.postgres_admin_password_key]
+}
+
+provider "postgresql" {
+  host     = var.postgres_host
+  port     = 5432
+  username = local.postgres_admin_user
+  password = local.postgres_admin_password
+  sslmode  = "require"
+}
+
+provider "random" {}
+
+variable "postgres_host" {
+  description = "LoadBalancer IP of the CNPG main-rw service."
+  type        = string
+}
+
+variable "vault_kv_mount" {
+  description = "Vault KV v2 mount containing PostgreSQL admin credentials."
+  type        = string
+  default     = "secret"
+}
+
+variable "postgres_admin_vault_path" {
+  description = "Vault KV path containing the PostgreSQL admin credentials."
+  type        = string
+  default     = "postgres/admin"
+}
+
+variable "postgres_admin_user_key" {
+  description = "Key in postgres_admin_vault_path containing the PostgreSQL admin username."
+  type        = string
+  default     = "username"
+}
+
+variable "postgres_admin_password_key" {
+  description = "Key in postgres_admin_vault_path containing the PostgreSQL admin password."
+  type        = string
+  default     = "password"
+}

terraform/internal/postgres/quay.tf

@@ -0,0 +1,58 @@
+resource "random_password" "quay" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "quay" {
+  name     = "quay"
+  login    = true
+  password = random_password.quay.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "quay" {
+  name  = "quay"
+  owner = postgresql_role.quay.name
+}
+
+# Allows vault_db_admin to ALTER ROLE quay PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_quay" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.quay.name
+  with_admin_option = true
+}
+
+resource "postgresql_extension" "quay_pg_trgm" {
+  name     = "pg_trgm"
+  database = postgresql_database.quay.name
+}
+
+resource "random_password" "quay_clair" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "quay_clair" {
+  name     = "quay_clair"
+  login    = true
+  password = random_password.quay_clair.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "quay_clair" {
+  name  = "quay_clair"
+  owner = postgresql_role.quay_clair.name
+}
+
+# Allows vault_db_admin to ALTER ROLE quay_clair PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_quay_clair" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.quay_clair.name
+  with_admin_option = true
+}

terraform/internal/postgres/stalwart.tf

@@ -0,0 +1,25 @@
+resource "random_password" "stalwart" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "stalwart" {
+  name     = "stalwart"
+  login    = true
+  password = random_password.stalwart.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "stalwart" {
+  name  = "stalwart"
+  owner = postgresql_role.stalwart.name
+}
+
+resource "postgresql_grant_role" "vault_db_admin_stalwart" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.stalwart.name
+  with_admin_option = true
+}

terraform/internal/postgres/tf-state.tf

@@ -0,0 +1,25 @@
+resource "random_password" "tf_state" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "tf_state" {
+  name     = "tf_state"
+  login    = true
+  password = random_password.tf_state.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "tf_state" {
+  name  = "tf_state"
+  owner = postgresql_role.tf_state.name
+}
+
+resource "postgresql_grant_role" "vault_db_admin_tf_state" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.tf_state.name
+  with_admin_option = true
+}

terraform/internal/postgres/vault.tf

@@ -0,0 +1,24 @@
+# Vault's connection credential to PostgreSQL for the database engine.
+# Cannot be rotated by Vault (a service can't rotate its own bootstrap credential).
+# Password is generated once and lives in Terraform state.
+resource "random_password" "vault_db_admin" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "vault_db_admin" {
+  name        = "vault_db_admin"
+  login       = true
+  create_role = true
+  password    = random_password.vault_db_admin.result
+
+  lifecycle {
+    ignore_changes = [roles]
+  }
+}
+
+output "vault_db_admin_password" {
+  description = "Read by terraform/internal/vault via remote state to configure the database engine connection."
+  value       = random_password.vault_db_admin.result
+  sensitive   = true
+}

terraform/internal/postgres/zitadel.tf

@@ -0,0 +1,26 @@
+resource "random_password" "zitadel" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "zitadel" {
+  name     = "zitadel"
+  login    = true
+  password = random_password.zitadel.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "zitadel" {
+  name  = "zitadel"
+  owner = postgresql_role.zitadel.name
+}
+
+# Allows vault_db_admin to ALTER ROLE zitadel PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_zitadel" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.zitadel.name
+  with_admin_option = true
+}

terraform/internal/vault/.terraform.lock.hcl

@@ -0,0 +1,64 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/random" {
+  version     = "3.8.1"
+  constraints = "~> 3.8"
+  hashes = [
+    "h1:4XzXwVRt9H0n4AZt0fpNc0AuBIsZH2MF6enFO0Tgm/E=",
+    "h1:EHn3jsqOKhWjbg0X+psk0Ww96yz3N7ASqEKKuFvDFwo=",
+    "h1:HTRqTUdrtlIPsvneQRTTGUfU46vHJ0uI7lf26SNVSoo=",
+    "h1:K/OIbLGX0YNiuoDXlpkerSWyv+bjS97Z6YGUCGePPAw=",
+    "h1:LsYuJLZcYl1RiH7Hd3w90Ra5+k5cNqfdRUQXItkTI8Y=",
+    "h1:ZmWv79WB2oB8IuUyTylbl9zEeWyJVvjd0Uac+Lk6LVw=",
+    "h1:bXd92D1e8ahgUbZNQPoOe+VK+WfNRMP8wU3meagUtB4=",
+    "h1:nz02g0rqNAJ+KO1Lq5Krfp3qJCuhA4bJuV8jtUw99ss=",
+    "h1:tZP70yQDl6mKnTsDtx6tS6GReVb1lgb7WnlIIneXsHY=",
+    "zh:25c458c7c676f15705e872202dad7dcd0982e4a48e7ea1800afa5fc64e77f4c8",
+    "zh:2edeaf6f1b20435b2f81855ad98a2e70956d473be9e52a5fdf57ccd0098ba476",
+    "zh:44becb9d5f75d55e36dfed0c5beabaf4c92e0a2bc61a3814d698271c646d48e7",
+    "zh:7699032612c3b16cc69928add8973de47b10ce81b1141f30644a0e8a895b5cd3",
+    "zh:86d07aa98d17703de9fbf402c89590dc1e01dbe5671dd6bc5e487eb8fe87eee0",
+    "zh:8c411c77b8390a49a8a1bc9f176529e6b32369dd33a723606c8533e5ca4d68c1",
+    "zh:a5ecc8255a612652a56b28149994985e2c4dc046e5d34d416d47fa7767f5c28f",
+    "zh:aea3fe1a5669b932eda9c5c72e5f327db8da707fe514aaca0d0ef60cb24892f9",
+    "zh:f56e26e6977f755d7ae56fa6320af96ecf4bb09580d47cb481efbf27f1c5afff",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/vault" {
+  version     = "5.8.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:/OZCcd0X7F9y846SOlVUMItMtLDBwasYe+Mv3HF2I1Q=",
+    "h1:68t9TdU3ap9L+Ayewb478BIyv8rpEDIQxYq1xsq99fs=",
+    "h1:6MmwOTMo0TpjoMs27LNKfxD+kZypRclB2WrV1OgbWD4=",
+    "h1:8DpFTiNTio1Yal+kozfxkPabRvN8ucRyjVkRcKuCnCo=",
+    "h1:B1DuZ215BVQbK/70wahsWR6Wy16LMicdRCuThNgeBOg=",
+    "h1:EhuYG2XYdV7d3RuOB/r/KKv0k5XXtDoBMgrzPraH8yQ=",
+    "h1:FIRP0mpZpyDppetTZxzmaH2kd2E0o8As9w2CANYsEhE=",
+    "h1:KuT1QZ3kyjqZ/YENs5ABfhSHEBLr/01ZWzWbJrS+vDo=",
+    "h1:SMqA7BA2Nv/R4O8oVi8arc1E2NXz56dcnp54vFG9sfg=",
+    "h1:TO99KdU92KULAbT4D0CJSeGFLuEsOgR10d6qFnR3dDk=",
+    "h1:Y3HaoTjTuH4UePPja1vDrRxrSTNhR7wq//qJsJA7/rQ=",
+    "h1:bd5YeFG+ok71bEUWdvksBLPWBWVpeosSl0rbbDJAigE=",
+    "h1:eSjvykpglWlaCF/77dluIgXQ/SbPlh7RSSuLjAYNZUs=",
+    "h1:lUnHYFRPEO+C+DwumShhX7va0iY9ApkhoSSj/P7vCsk=",
+    "h1:qFAesj3MEaAzGFL2tvV+uy/biNwGJUculuN5CFtTh1E=",
+    "zh:1c9d0b740520a88a16ccc57c6bcb1a58e47b6ba19676428b2a0f5b9fe4004788",
+    "zh:274ad5bad107a845927773a6a31a45cd0ed7916fa52b86d85c86c535b59fcea4",
+    "zh:2b2eef2cb6840c3cf41134b1d1b6d3d50d6edbe3b2af2318bf7101843072c83b",
+    "zh:42b607a2983e77a47099b5ac8550a25ecd5ba03760be19749a4ad63617ea6085",
+    "zh:544877ac091e54b2954f5638edf06d76f344eb6833fb68db961c0edb5b0fdc83",
+    "zh:812bd7730efb3781fcfc7442650551d30b015f931a132ae9acdffdd625526908",
+    "zh:8798d164f8e25f3b211be45e79d3bd5272e9237e728942c0026300b25798e5fe",
+    "zh:91201a2e5dbc88013977960f0d1139fb584cdcda1cfd27577980d8cf0a31ead3",
+    "zh:a532662249b28e10a065bbab467d4ea9a12719638fe0f7e0add05d8d11142366",
+    "zh:ab91b32cbcc71cd9e89cca7d88957d9410f54750f7ea60f1416d2d77b478006a",
+    "zh:ae5658b04277318c8b91c0a9ed2ec05dd324a7501c1a057d53e79b0e1978a1f6",
+    "zh:e02581fca392f46738a95999d5fbccca7d82500df3a88e16ae9668633eb16f9b",
+    "zh:e89f59329ee939b59158c6173484ef4376da44296f6153d2fbafd3e28bd650c5",
+    "zh:e9ac49b94293cb5c8b31eb6e5afddc6134ffff0481ec195b242e0175e1f6766f",
+    "zh:ef60d5715c3b82ae64643dea9b4c1a82c10f72151c77af2749d3ceb060bb2adb",
+  ]
+}

terraform/internal/vault/agentgateway.tf

@@ -0,0 +1,22 @@
+resource "vault_policy" "agentgateway" {
+  name = "agentgateway"
+
+  policy = <<-EOT
+    path "secret/data/agentgateway/*" {
+      capabilities = ["read"]
+    }
+    path "secret/data/quay/robots/cluster_pull" {
+      capabilities = ["read"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "agentgateway" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "agentgateway"
+  bound_service_account_names      = ["agentgateway-vso"]
+  bound_service_account_namespaces = ["agentgateway-system"]
+  token_policies                   = [vault_policy.agentgateway.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}

terraform/internal/vault/argo.tf

@@ -0,0 +1,30 @@
+resource "random_password" "versitygw_argo_secret_access_key" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "versitygw_argo_user" {
+  mount = vault_mount.secret.path
+  name  = "versitygw/users/argo"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    secretAccessKey = random_password.versitygw_argo_secret_access_key.result
+  })
+
+  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
+}
+
+resource "vault_kv_secret_v2" "argo_artifacts" {
+  mount = vault_mount.secret.path
+  name  = "argo/artifacts"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    access_key_id     = "********"
+    secret_access_key = random_password.versitygw_argo_secret_access_key.result
+    internal_ca_cert  = vault_pki_secret_backend_root_cert.root.certificate
+  })
+
+  # Keep in lockstep with versitygw/users/argo until rotation is designed.
+}