ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/postgres/quay.tf

@@ -0,0 +1,58 @@
+resource "random_password" "quay" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "quay" {
+  name     = "quay"
+  login    = true
+  password = random_password.quay.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "quay" {
+  name  = "quay"
+  owner = postgresql_role.quay.name
+}
+
+# Allows vault_db_admin to ALTER ROLE quay PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_quay" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.quay.name
+  with_admin_option = true
+}
+
+resource "postgresql_extension" "quay_pg_trgm" {
+  name     = "pg_trgm"
+  database = postgresql_database.quay.name
+}
+
+resource "random_password" "quay_clair" {
+  length  = 32
+  special = false
+}
+
+resource "postgresql_role" "quay_clair" {
+  name     = "quay_clair"
+  login    = true
+  password = random_password.quay_clair.result
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}
+
+resource "postgresql_database" "quay_clair" {
+  name  = "quay_clair"
+  owner = postgresql_role.quay_clair.name
+}
+
+# Allows vault_db_admin to ALTER ROLE quay_clair PASSWORD '...' for credential rotation.
+resource "postgresql_grant_role" "vault_db_admin_quay_clair" {
+  role              = postgresql_role.vault_db_admin.name
+  grant_role        = postgresql_role.quay_clair.name
+  with_admin_option = true
+}