ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/vault/forgejo-public.tf

@@ -0,0 +1,65 @@
+resource "random_password" "versitygw_forgejo_public_secret_access_key" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "versitygw_forgejo_public_user" {
+  mount = vault_mount.secret.path
+  name  = "versitygw/users/forgejo-public"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    secretAccessKey = random_password.versitygw_forgejo_public_secret_access_key.result
+  })
+}
+
+resource "random_password" "forgejo_public_dragonfly_password" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "dragonfly_forgejo_public_acl" {
+  mount = vault_mount.secret.path
+  name  = "dragonfly/forgejo-public/acl"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    acl = "user default on >${random_password.forgejo_public_dragonfly_password.result} ~* &* +@all\n"
+  })
+}
+
+resource "random_password" "forgejo_public_secret_key" {
+  length  = 64
+  special = false
+}
+
+resource "random_password" "forgejo_public_internal_token" {
+  length  = 64
+  special = false
+}
+
+resource "random_password" "forgejo_public_oauth2_jwt_secret" {
+  length  = 64
+  special = false
+}
+
+resource "random_password" "forgejo_public_lfs_jwt_secret" {
+  length  = 64
+  special = false
+}
+
+resource "vault_kv_secret_v2" "forgejo_public_secrets" {
+  mount = vault_mount.secret.path
+  name  = "forgejo-public/secrets"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    secret_key        = random_password.forgejo_public_secret_key.result
+    internal_token    = random_password.forgejo_public_internal_token.result
+    oauth2_jwt_secret = random_password.forgejo_public_oauth2_jwt_secret.result
+    lfs_jwt_secret    = random_password.forgejo_public_lfs_jwt_secret.result
+    redis_password    = random_password.forgejo_public_dragonfly_password.result
+    s3_secret_key     = random_password.versitygw_forgejo_public_secret_access_key.result
+    internal_ca_cert  = vault_pki_secret_backend_root_cert.root.certificate
+  })
+}