ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

100
terraform/internal/vault/database.tf Normal file
View file

@ -0,0 +1,100 @@
data "terraform_remote_state" "postgres" {
backend = "pg"
config = {
conn_str = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
schema_name = "internal_postgres"
}
}
resource "vault_mount" "database" {
path = "database"
type = "database"
}
resource "vault_database_secret_backend_connection" "postgres" {
backend = vault_mount.database.path
name = "postgres"
allowed_roles = ["zitadel", "forgejo", "forgejo-public", "grafana", "quay", "quay_clair", "argo", "stalwart", "tf-state", "hf-chat-ui"]
postgresql {
connection_url = "postgresql://{{username}}:{{password}}@main-rw.postgres.svc.cluster.local:5432/postgres?sslmode=require"
username = "********"
password = data.terraform_remote_state.postgres.outputs.vault_db_admin_password
}
}
locals {
db_static_rotation_schedule = "0 19 * * 0"
}
resource "vault_database_secret_backend_static_role" "zitadel" {
backend = vault_mount.database.path
name = "zitadel"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "forgejo" {
backend = vault_mount.database.path
name = "forgejo"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "forgejo_public" {
backend = vault_mount.database.path
name = "forgejo-public"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "grafana" {
backend = vault_mount.database.path
name = "grafana"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "quay" {
backend = vault_mount.database.path
name = "quay"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "quay_clair" {
backend = vault_mount.database.path
name = "quay_clair"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "argo" {
backend = vault_mount.database.path
name = "argo"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "stalwart" {
backend = vault_mount.database.path
name = "stalwart"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_database_secret_backend_static_role" "tf_state" {
backend = vault_mount.database.path
name = "tf-state"
db_name = vault_database_secret_backend_connection.postgres.name
username = "********"
rotation_schedule = local.db_static_rotation_schedule
}