ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
--- a/terraform/internal/vault/stalwart.tf
+++ b/terraform/internal/vault/stalwart.tf
@ -0,0 +1,139 @@
+resource "random_password" "versitygw_stalwart_secret_access_key" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "versitygw_stalwart_user" {
+  mount = vault_mount.secret.path
+  name  = "versitygw/users/stalwart"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    secretAccessKey = random_password.versitygw_stalwart_secret_access_key.result
+  })
+}
+
+resource "random_password" "stalwart_dragonfly_password" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "dragonfly_stalwart_acl" {
+  mount = vault_mount.secret.path
+  name  = "dragonfly/stalwart/acl"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    acl = "user default on >${random_password.stalwart_dragonfly_password.result} ~* &* +@all\n"
+  })
+}
+
+resource "random_password" "stalwart_recovery_admin" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "stalwart_runtime" {
+  mount = vault_mount.secret.path
+  name  = "stalwart/runtime"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    dragonfly_password = random_password.stalwart_dragonfly_password.result
+    internal_ca_cert   = vault_pki_secret_backend_root_cert.root.certificate
+    s3_secret_key      = random_password.versitygw_stalwart_secret_access_key.result
+  })
+}
+
+resource "vault_kv_secret_v2" "stalwart_bootstrap" {
+  mount = vault_mount.secret.path
+  name  = "stalwart/bootstrap-credentials"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    username       = "********"
+    password       = random_password.stalwart_recovery_admin.result
+    recovery_admin = "********"
+  })
+}
+
+resource "vault_kv_secret_v2" "stalwart_alert_identity" {
+  mount                = vault_mount.secret.path
+  name                 = "stalwart/alert-identity"
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({})
+}
+
+resource "vault_kv_secret_v2" "stalwart_zitadel_notification" {
+  mount = vault_mount.secret.path
+  name  = "stalwart/zitadel-notification"
+
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({})
+}
+
+resource "vault_kv_secret_v2" "stalwart_test_client" {
+  mount                = vault_mount.secret.path
+  name                 = "stalwart/test-client"
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({})
+}
+
+resource "vault_kv_secret_v2" "stalwart_oci_email_delivery" {
+  mount                = vault_mount.secret.path
+  name                 = "stalwart/oci-email-delivery"
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({})
+}
+
+resource "vault_policy" "stalwart" {
+  name = "stalwart"
+
+  policy = <<-EOT
+    path "secret/data/stalwart/*" {
+      capabilities = ["read"]
+    }
+    path "secret/data/quay/robots/cluster_pull" {
+      capabilities = ["read"]
+    }
+    path "database/static-creds/stalwart" {
+      capabilities = ["read"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "stalwart" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "stalwart"
+  bound_service_account_names      = ["stalwart"]
+  bound_service_account_namespaces = ["stalwart"]
+  token_policies                   = [vault_policy.stalwart.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}
+
+resource "vault_policy" "stalwart_cred_writer" {
+  name = "stalwart-cred-writer"
+
+  policy = <<-EOT
+    path "secret/data/stalwart/alert-identity" {
+      capabilities = ["create", "read", "update"]
+    }
+    path "secret/data/stalwart/zitadel-notification" {
+      capabilities = ["create", "read", "update"]
+    }
+    path "secret/data/stalwart/test-client" {
+      capabilities = ["create", "read", "update"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "stalwart_cred_writer" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "stalwart-cred-writer"
+  bound_service_account_names      = ["stalwart"]
+  bound_service_account_namespaces = ["stalwart"]
+  token_policies                   = [vault_policy.stalwart_cred_writer.name]
+  token_ttl                        = 600
+  token_max_ttl                    = 600
+}