ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/postgres/.terraform.lock.hcl

@@ -0,0 +1,99 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/cyrilgdn/postgresql" {
+  version     = "1.26.0"
+  constraints = "~> 1.26"
+  hashes = [
+    "h1:7RvWsnQOenYEBG8qA0nQtrsz32FEhS9RXAS40ncOx80=",
+    "h1:8bXFg6KkLzUAd44WUnqSxVY0pqXALT14h59OlYq3UTY=",
+    "h1:D4Q68dTDZHAeGeJDR4p1ilmxS9bVm4B9eDsY3Omjn/E=",
+    "h1:DsAiYnizf3W62ERIfshpIDhzMIqgLQvwwCun3Uuu1Cs=",
+    "h1:EQH2pCkaR0vf3OyzyEr/SdYTg6JCrgSV1WYxkRYCUtc=",
+    "h1:FaTc/yPD5/Fp4Mchju/bIvRJAuCikrrH4pRMoUZKs2k=",
+    "h1:MKR/hM2mwly5/lv+8j06B7BqPz8RUcFvvTZn2BZqWGM=",
+    "h1:OmjWcf08BwORkQ+VpOw1qlh2LE4ZR/huj9KZt2IRHsQ=",
+    "h1:RBYmB7ASNzcKarvfqSGw260ZKd+m5Dxbp5SKcSWyc0Q=",
+    "h1:VAxyMQCSN17laQb0YW98bbo3p6MvgdJOkN20gkDEWF0=",
+    "h1:WEFcXvxxzMtbumRdCSYLd+iVQmgWkNZHos7KcXXL7k8=",
+    "h1:YmlWzleORO+YHWjcQuNgFG9rJbL70QErM6QHXz2YDeQ=",
+    "h1:aY3oidJAUFs53Rmpa2L2uC+8f1ZdEbS9k7LZ7d4s3Gk=",
+    "h1:kId855uQr126ruzaPg2KA5EZ+j2fwASTZOK4QplxyBY=",
+    "zh:0f2ec2bb24f8bb9eb232f1650d6459a2bac732bf91bbc08b27ae5519bee89486",
+    "zh:11dafcec9c7e6e2c8b6303d90c6061973db26f6f84adc2be02fe66e9b1b11561",
+    "zh:13a67dc639ee053cbecc6ab28fd5bfca4780e680bd12491f1bdf0f8243fd364a",
+    "zh:56337a42348bb9ab31837caa89d89f7a3ee0528b5a6d04a6a93a8ea155eb7f4d",
+    "zh:590e80218e70e8081a11cf1f5df16014426d6ba8c2552713cc61f56041c7457b",
+    "zh:5e4b12dd1874bab454720a50c600d1df359dc71f91f4a0194cf8eb335e27dfe7",
+    "zh:6af55f892e7f463c75a62215dc74790ae9a71d7d23c74c6ddb40af258528fa46",
+    "zh:78f6739ca865622981c28fa6628128be4651bd4629450a9ba5b1945d64b66da7",
+    "zh:8ed469b0d9074eba59216e57794a03fe27b45586b03d24946d130949ae92093f",
+    "zh:a261aaee5675986711cf9f963d5d9ca5ec1d62aa8c31866da54c6670d803b8a3",
+    "zh:a64b52597738ff1bac41127141c48800f1575eaa66a67cecdc9b0b16728dae0e",
+    "zh:ae5e821f5d5510bc2cba2aefcf6c0e62af9e28b7a25e0e8dcd039e04172594d0",
+    "zh:cfae79ed700febe8fb29fd1c5d0a6ace0a0103bef8ec37bb653dc23afc960b33",
+    "zh:d9a69d5475982a00d4e9e07f56987c821782595bac29e9084237285d36fa88e8",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/random" {
+  version     = "3.8.1"
+  constraints = "~> 3.8"
+  hashes = [
+    "h1:4XzXwVRt9H0n4AZt0fpNc0AuBIsZH2MF6enFO0Tgm/E=",
+    "h1:EHn3jsqOKhWjbg0X+psk0Ww96yz3N7ASqEKKuFvDFwo=",
+    "h1:HTRqTUdrtlIPsvneQRTTGUfU46vHJ0uI7lf26SNVSoo=",
+    "h1:K/OIbLGX0YNiuoDXlpkerSWyv+bjS97Z6YGUCGePPAw=",
+    "h1:LsYuJLZcYl1RiH7Hd3w90Ra5+k5cNqfdRUQXItkTI8Y=",
+    "h1:ZmWv79WB2oB8IuUyTylbl9zEeWyJVvjd0Uac+Lk6LVw=",
+    "h1:bXd92D1e8ahgUbZNQPoOe+VK+WfNRMP8wU3meagUtB4=",
+    "h1:nz02g0rqNAJ+KO1Lq5Krfp3qJCuhA4bJuV8jtUw99ss=",
+    "h1:tZP70yQDl6mKnTsDtx6tS6GReVb1lgb7WnlIIneXsHY=",
+    "zh:25c458c7c676f15705e872202dad7dcd0982e4a48e7ea1800afa5fc64e77f4c8",
+    "zh:2edeaf6f1b20435b2f81855ad98a2e70956d473be9e52a5fdf57ccd0098ba476",
+    "zh:44becb9d5f75d55e36dfed0c5beabaf4c92e0a2bc61a3814d698271c646d48e7",
+    "zh:7699032612c3b16cc69928add8973de47b10ce81b1141f30644a0e8a895b5cd3",
+    "zh:86d07aa98d17703de9fbf402c89590dc1e01dbe5671dd6bc5e487eb8fe87eee0",
+    "zh:8c411c77b8390a49a8a1bc9f176529e6b32369dd33a723606c8533e5ca4d68c1",
+    "zh:a5ecc8255a612652a56b28149994985e2c4dc046e5d34d416d47fa7767f5c28f",
+    "zh:aea3fe1a5669b932eda9c5c72e5f327db8da707fe514aaca0d0ef60cb24892f9",
+    "zh:f56e26e6977f755d7ae56fa6320af96ecf4bb09580d47cb481efbf27f1c5afff",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/vault" {
+  version     = "5.8.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:/OZCcd0X7F9y846SOlVUMItMtLDBwasYe+Mv3HF2I1Q=",
+    "h1:68t9TdU3ap9L+Ayewb478BIyv8rpEDIQxYq1xsq99fs=",
+    "h1:6MmwOTMo0TpjoMs27LNKfxD+kZypRclB2WrV1OgbWD4=",
+    "h1:8DpFTiNTio1Yal+kozfxkPabRvN8ucRyjVkRcKuCnCo=",
+    "h1:B1DuZ215BVQbK/70wahsWR6Wy16LMicdRCuThNgeBOg=",
+    "h1:EhuYG2XYdV7d3RuOB/r/KKv0k5XXtDoBMgrzPraH8yQ=",
+    "h1:FIRP0mpZpyDppetTZxzmaH2kd2E0o8As9w2CANYsEhE=",
+    "h1:KuT1QZ3kyjqZ/YENs5ABfhSHEBLr/01ZWzWbJrS+vDo=",
+    "h1:SMqA7BA2Nv/R4O8oVi8arc1E2NXz56dcnp54vFG9sfg=",
+    "h1:TO99KdU92KULAbT4D0CJSeGFLuEsOgR10d6qFnR3dDk=",
+    "h1:Y3HaoTjTuH4UePPja1vDrRxrSTNhR7wq//qJsJA7/rQ=",
+    "h1:bd5YeFG+ok71bEUWdvksBLPWBWVpeosSl0rbbDJAigE=",
+    "h1:eSjvykpglWlaCF/77dluIgXQ/SbPlh7RSSuLjAYNZUs=",
+    "h1:lUnHYFRPEO+C+DwumShhX7va0iY9ApkhoSSj/P7vCsk=",
+    "h1:qFAesj3MEaAzGFL2tvV+uy/biNwGJUculuN5CFtTh1E=",
+    "zh:1c9d0b740520a88a16ccc57c6bcb1a58e47b6ba19676428b2a0f5b9fe4004788",
+    "zh:274ad5bad107a845927773a6a31a45cd0ed7916fa52b86d85c86c535b59fcea4",
+    "zh:2b2eef2cb6840c3cf41134b1d1b6d3d50d6edbe3b2af2318bf7101843072c83b",
+    "zh:42b607a2983e77a47099b5ac8550a25ecd5ba03760be19749a4ad63617ea6085",
+    "zh:544877ac091e54b2954f5638edf06d76f344eb6833fb68db961c0edb5b0fdc83",
+    "zh:812bd7730efb3781fcfc7442650551d30b015f931a132ae9acdffdd625526908",
+    "zh:8798d164f8e25f3b211be45e79d3bd5272e9237e728942c0026300b25798e5fe",
+    "zh:91201a2e5dbc88013977960f0d1139fb584cdcda1cfd27577980d8cf0a31ead3",
+    "zh:a532662249b28e10a065bbab467d4ea9a12719638fe0f7e0add05d8d11142366",
+    "zh:ab91b32cbcc71cd9e89cca7d88957d9410f54750f7ea60f1416d2d77b478006a",
+    "zh:ae5658b04277318c8b91c0a9ed2ec05dd324a7501c1a057d53e79b0e1978a1f6",
+    "zh:e02581fca392f46738a95999d5fbccca7d82500df3a88e16ae9668633eb16f9b",
+    "zh:e89f59329ee939b59158c6173484ef4376da44296f6153d2fbafd3e28bd650c5",
+    "zh:e9ac49b94293cb5c8b31eb6e5afddc6134ffff0481ec195b242e0175e1f6766f",
+    "zh:ef60d5715c3b82ae64643dea9b4c1a82c10f72151c77af2749d3ceb060bb2adb",
+  ]
+}

terraform/internal/postgres/argo.tf

@@ -0,0 +1,26 @@
+resource "random_password" "argo" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "argo" {
+  name     = "argo"
+  login    = true
+  password = random_password.argo.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "argo" {
+  name  = "argo"
+  owner = postgresql_role.argo.name
+}
+
+# Allows vault_db_admin to ALTER ROLE argo PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_argo" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.argo.name
+  with_admin_option = true
+}

terraform/internal/postgres/forgejo-public.tf

@@ -0,0 +1,25 @@
+resource "random_password" "forgejo_public" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "forgejo_public" {
+  name     = "forgejo_public"
+  login    = true
+  password = random_password.forgejo_public.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "forgejo_public" {
+  name  = "forgejo_public"
+  owner = postgresql_role.forgejo_public.name
+}
+
+resource "postgresql_grant_role" "vault_db_admin_forgejo_public" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.forgejo_public.name
+  with_admin_option = true
+}

terraform/internal/postgres/forgejo.tf

@@ -0,0 +1,26 @@
+resource "random_password" "forgejo" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "forgejo" {
+  name     = "forgejo"
+  login    = true
+  password = random_password.forgejo.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "forgejo" {
+  name  = "forgejo"
+  owner = postgresql_role.forgejo.name
+}
+
+# Allows vault_db_admin to ALTER ROLE forgejo PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_forgejo" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.forgejo.name
+  with_admin_option = true
+}

terraform/internal/postgres/grafana.tf

@@ -0,0 +1,26 @@
+resource "random_password" "grafana" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "grafana" {
+  name     = "grafana"
+  login    = true
+  password = random_password.grafana.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "grafana" {
+  name  = "grafana"
+  owner = postgresql_role.grafana.name
+}
+
+# Allows vault_db_admin to ALTER ROLE grafana PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_grafana" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.grafana.name
+  with_admin_option = true
+}

terraform/internal/postgres/hf-chat-ui.tf

@@ -0,0 +1,25 @@
+resource "random_password" "hf_chat_ui" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "hf_chat_ui" {
+  name     = "hf_chat_ui"
+  login    = true
+  password = random_password.hf_chat_ui.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "hf_chat_ui" {
+  name  = "hf_chat_ui"
+  owner = postgresql_role.hf_chat_ui.name
+}
+
+resource "postgresql_grant_role" "hf_rotation" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.hf_chat_ui.name
+  with_admin_option = true
+}

terraform/internal/postgres/providers.tf

@@ -0,0 +1,73 @@
+terraform {
+  required_version = "< 2.0.0"
+  backend "pg" {
+    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
+    schema_name = "internal_postgres"
+  }
+
+  required_providers {
+    postgresql = {
+      source  = "cyrilgdn/postgresql"
+      version = "~> 1.26"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.8"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "vault" {}
+
+ephemeral "vault_kv_secret_v2" "postgres_admin" {
+  mount = var.vault_kv_mount
+  name  = var.postgres_admin_vault_path
+}
+
+locals {
+  postgres_admin_user     = ephemeral.vault_kv_secret_v2.postgres_admin.data[var.postgres_admin_user_key]
+  postgres_admin_password = ephemeral.vault_kv_secret_v2.postgres_admin.data[var.postgres_admin_password_key]
+}
+
+provider "postgresql" {
+  host     = var.postgres_host
+  port     = 5432
+  username = local.postgres_admin_user
+  password = local.postgres_admin_password
+  sslmode  = "require"
+}
+
+provider "random" {}
+
+variable "postgres_host" {
+  description = "LoadBalancer IP of the CNPG main-rw service."
+  type        = string
+}
+
+variable "vault_kv_mount" {
+  description = "Vault KV v2 mount containing PostgreSQL admin credentials."
+  type        = string
+  default     = "secret"
+}
+
+variable "postgres_admin_vault_path" {
+  description = "Vault KV path containing the PostgreSQL admin credentials."
+  type        = string
+  default     = "postgres/admin"
+}
+
+variable "postgres_admin_user_key" {
+  description = "Key in postgres_admin_vault_path containing the PostgreSQL admin username."
+  type        = string
+  default     = "username"
+}
+
+variable "postgres_admin_password_key" {
+  description = "Key in postgres_admin_vault_path containing the PostgreSQL admin password."
+  type        = string
+  default     = "password"
+}

terraform/internal/postgres/quay.tf

@@ -0,0 +1,58 @@
+resource "random_password" "quay" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "quay" {
+  name     = "quay"
+  login    = true
+  password = random_password.quay.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "quay" {
+  name  = "quay"
+  owner = postgresql_role.quay.name
+}
+
+# Allows vault_db_admin to ALTER ROLE quay PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_quay" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.quay.name
+  with_admin_option = true
+}
+
+resource "postgresql_extension" "quay_pg_trgm" {
+  name     = "pg_trgm"
+  database = postgresql_database.quay.name
+}
+
+resource "random_password" "quay_clair" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "quay_clair" {
+  name     = "quay_clair"
+  login    = true
+  password = random_password.quay_clair.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "quay_clair" {
+  name  = "quay_clair"
+  owner = postgresql_role.quay_clair.name
+}
+
+# Allows vault_db_admin to ALTER ROLE quay_clair PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_quay_clair" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.quay_clair.name
+  with_admin_option = true
+}

terraform/internal/postgres/stalwart.tf

@@ -0,0 +1,25 @@
+resource "random_password" "stalwart" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "stalwart" {
+  name     = "stalwart"
+  login    = true
+  password = random_password.stalwart.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "stalwart" {
+  name  = "stalwart"
+  owner = postgresql_role.stalwart.name
+}
+
+resource "postgresql_grant_role" "vault_db_admin_stalwart" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.stalwart.name
+  with_admin_option = true
+}

terraform/internal/postgres/tf-state.tf

@@ -0,0 +1,25 @@
+resource "random_password" "tf_state" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "tf_state" {
+  name     = "tf_state"
+  login    = true
+  password = random_password.tf_state.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "tf_state" {
+  name  = "tf_state"
+  owner = postgresql_role.tf_state.name
+}
+
+resource "postgresql_grant_role" "vault_db_admin_tf_state" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.tf_state.name
+  with_admin_option = true
+}

terraform/internal/postgres/vault.tf

@@ -0,0 +1,24 @@
+# Vault's connection credential to PostgreSQL for the database engine.
+# Cannot be rotated by Vault (a service can't rotate its own bootstrap credential).
+# Password is generated once and lives in Terraform state.
+resource "random_password" "vault_db_admin" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "vault_db_admin" {
+  name        = "vault_db_admin"
+  login       = true
+  create_role = true
+  password    = random_password.vault_db_admin.result
+
+  lifecycle {
+    ignore_changes = [roles]
+  }
+}
+
+output "vault_db_admin_password" {
+  description = "Read by terraform/internal/vault via remote state to configure the database engine connection."
+  value       = random_password.vault_db_admin.result
+  sensitive   = true
+}

terraform/internal/postgres/zitadel.tf

@@ -0,0 +1,26 @@
+resource "random_password" "zitadel" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "zitadel" {
+  name     = "zitadel"
+  login    = true
+  password = random_password.zitadel.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "zitadel" {
+  name  = "zitadel"
+  owner = postgresql_role.zitadel.name
+}
+
+# Allows vault_db_admin to ALTER ROLE zitadel PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_zitadel" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.zitadel.name
+  with_admin_option = true
+}