ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/forgejo/main.tf

@@ -0,0 +1,41 @@
+resource "forgejo_organization" "gitops" {
+  name      = var.organization_name
+  full_name = var.organization_full_name
+}
+
+resource "forgejo_repository" "gitops" {
+  owner       = forgejo_organization.gitops.name
+  name        = var.repository_name
+  description = var.repository_description
+  private     = true
+  auto_init   = false
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "tls_private_key" "flux_git" {
+  algorithm = "ED25519"
+}
+
+resource "forgejo_deploy_key" "flux_git" {
+  repository_id = forgejo_repository.gitops.id
+  title         = var.flux_git_deploy_key_title
+  key           = trimspace(tls_private_key.flux_git.public_key_openssh)
+  read_only     = true
+}
+
+resource "vault_kv_secret_v2" "flux_git_ssh" {
+  mount = var.vault_kv_mount
+  name  = var.flux_git_ssh_vault_path
+
+  data_json = jsonencode({
+    identity       = tls_private_key.flux_git.private_key_pem
+    "identity.pub" = trimspace(tls_private_key.flux_git.public_key_openssh)
+    known_hosts    = trimspace(var.flux_git_ssh_known_hosts)
+  })
+
+  # Vault is source of truth after first write. Flux deploy key rotation is explicit.
+  lifecycle { ignore_changes = [data_json] }
+}