ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
18 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

84
terraform/internal/versitygw/.terraform.lock.hcl generated Normal file
View file

@ -0,0 +1,84 @@
# This file is maintained automatically by "tofu init".
# Manual edits may be lost in future updates.
provider "registry.opentofu.org/aminueza/minio" {
version = "3.33.1"
constraints = "~> 3.30"
hashes = [
"h1:6rCNIjlQZs9kC6UAvwfLEYyPOvX3l0gEmnV+BUcB5wU=",
"h1:70zXp/Tx4JuvJYQx4Sev44qOHO4bh5EuuFn/4OQhdIU=",
"h1:9/JAzpIEImlvIhttYZsjKpm2kW2eYCZHe/Tdueki2mM=",
"h1:FJ39QTO826WkeBCOxpkLDxAtLUc1Yszbymsf5cqnEhk=",
"h1:FxSLRqOGvL8t/HaHl+fmAhnj+TeIiWhxGgXOr0Y5u/g=",
"h1:GWxYpYxiRikWw2UfRiycVa5LkZOLKRMq7SmI49HWEqw=",
"h1:ItukZcSNny3kEzqKkKfsa7k2hoK2aGmnWR2J1h9+eQU=",
"h1:M3HGuzldP8ZIXwoqCJgvQ3d99uDdEqLFvvufGz34NJM=",
"h1:R7o0Ctk15enKr25KAgDIp6iIhkQcu1xyw3QE3CBaGMQ=",
"h1:TUTQzSenrdxU4lcvyPPIH/zmVtUkqmcJuqQfip1EV1E=",
"h1:iFyX5X3XD+PZ8OhT86JCoYWTcP5MpRQtxX/eAGXGGnY=",
"h1:n+rRmGvs31DTk0yP2elN0c7PzDdTDxdQsiH6AdFankE=",
"h1:zJ60CJsMSlAiaVlQ9qrJ+YX2zfTz9j1qcg3wE72q2MQ=",
"zh:040233653657643f97952d12c30265859e9d83066c0c1f814413e5b40f76e377",
"zh:08f3874277b2a37ee63deb9aa8075a5251494f2569c3c8864c0afdc420536156",
"zh:3ec7c4ae846c9c634ee0e4e93860c8a1238cef008aa28c0deec776e246754e59",
"zh:4f6c7127b1677226b1adb2f779983d4282dc4e645dbf54fae67697c6c067d134",
"zh:61c891e66c27e11acd57aaa89bf159843811d04fda7c59378fca0bb9baf3e2ad",
"zh:696d1af0906d2a422109fad6addf765b7d42724c01c64e3b42ae0e688001bd18",
"zh:7859f6bc3f59e72e52a29d7cb46a561ae3fcc5e04c2955d836816aa409184de2",
"zh:7fbcee51a935388988f55c5b7b68855e2c6e9f690b3805b64b76db35b064a7cd",
"zh:88e5612354fb06d7835996c4351aa4e2f7bcb15bb84d0b79b39dee3c48d5a157",
"zh:9b541c98a8ea82851ff684fb6e0fe67be78194b4431d01843a28f79de8c77d1f",
"zh:b297f50ee5d48f3c6022b4872ad3e299c3fa245585874ba00ae334be43cd1d41",
"zh:e035a01fb73255879df0b1255dfc37dde04c8d564dadcb8a3c644572f30affa7",
"zh:ed72df7536a2456411f90837b1e09852c2eb815babaf651fa104a7106dcd2942",
]
}
provider "registry.opentofu.org/hashicorp/vault" {
version = "5.9.0"
constraints = "~> 5.0"
hashes = [
"h1:1gPhHdepbhh8o4actbPTj1NNmHp9RGlZHNHS8Q7cGhY=",
"h1:9U4AT36IqNYXfQMR7nf+oywulVKYua473W4NmuwVb7M=",
"h1:Cv/QPFgUzjuL9iUJDg24y418QEi8SMdRvVlSMkFiz7c=",
"h1:EIoxVYFdrHFt/7K+dn01pyPqtnG7aCAV9oxciBuPf38=",
"h1:GhXZZwSBkZ72u1mz2s7n6PVRrVHluduNshwiWCqCOmg=",
"h1:Gql2ewdOADMus4u/oUrNiPWq1f0RjeEnENKCB0TOeYo=",
"h1:NxidKSSMEaWEqHqDZeazsdAnoedVjEBRTJ3DRW87/4M=",
"h1:WvfYFv/S92FXpboMJk4/5ITJiA2uR3M+TMTmv/8FtsE=",
"h1:aXw2YlnysLvtKbBzKfHkivAyd3FruF+h36FhFJvcp1U=",
"h1:ajg+P0+I86N1plXhsYKpT9DQ69fAZMwke63Hk/K6WJg=",
"h1:cJ7BEXNTXkxvsURhfIAXkeexwQK6XI4oXsjjjzT04GM=",
"h1:hbOrF6PzE5BbIvjpc4emswGQ7mlKT32KA91Jg7nOV3w=",
"h1:qk+rk5u7m3tzKgC3ZywUYED3Hj2DLk9tRLQaYj0Ns5c=",
"h1:seIRmmZYX8Bi2gKsLkGwh4mz/WJJ+e2haRj9DnEzPCg=",
"h1:tda6iYscvfKYglCVwWp9J/9HEoJohBDkqitEB2l2xCA=",
"zh:03cb46fab606872e3fc06e27f8d14b911b7a9781d0f32af335c7287a9dbe4f4f",
"zh:1e69677b09329b009a8791f9cbb556790fb4dbddc1360f953345259892dc6c5b",
"zh:4e5a3dc82e70d88f5671968b7f2217163815be259d0b26dfcc9a897409c491fa",
"zh:51b82b358fe52099ef29cae62e2040ae0224ceea40a7dfdf0b69de90fb0233a8",
"zh:60ec3477fbe712b3269eec2e4d9d5921e2e68d0861d77e11e91bea088aab27bf",
"zh:64e58a3e3fd61005b54d71eee792b8576ab42ea4cd711515043a3ac0d8bc7919",
"zh:69142fb83aff31e27f5b3d9e7afb7594013b63e490cfcef8678fd0d724609359",
"zh:6f2e58ba6bd41c4d9e0e752e55eb7d86104f9d786cf57fa8dc960c61b574f9ce",
"zh:73390b7cb186310e5aaf4a1baaa639ab0302a8da4db130b4e28ebced3ba103fe",
"zh:a2214b3fda93cfed89ba1a7d714fe8b015176927605b215365978efdaae1c6db",
"zh:b275ee0f0a63765364d2e6979e3a11464d2c2ce6d3ce9bd15b3f503aea6f12b0",
"zh:bb2cd553b1c589a0f6f5b0575e1b176a9d91c1b20c6375d1afd63bb2a47fd014",
"zh:bc38e48ae5cdb8219fef326366f46e6a25e7f77f9bbcd9bdc80c7cb960de81ed",
"zh:e54af55cf667759a400af07b927b5034f1733e6527f9352b84001205561dcf9e",
"zh:f617688ef4568c0de8a28d5e1fa3714fb2eeab9f8cf7bcf20af42a1a511844be",
]
}
provider "registry.opentofu.org/quorate/versitygw" {
version = "0.0.1"
constraints = "0.0.1"
hashes = [
"h1:7gqGpYD31d96LMq8x5sk/iwsTZ2zj8lDT8icxOcPak4=",
"h1:8uHhg8iakI05tcM3ckOKVt98pNih/NjX9MIwoBaLQi8=",
"h1:AJL9xyk2w6A3wb3QVRpd0lRyVd9RwKADba+YFzEXhg4=",
"h1:T2xg1ub1SvsPr5SdYdvS3W5F3hx7SBhghwyPwTYrh64=",
"h1:i0uwt+xRc55yc8Chmkty2yHJ/jvXEFz4G7ib0DNH804=",
]
}

63
terraform/internal/versitygw/argo.tf Normal file
View file

@ -0,0 +1,63 @@
ephemeral "vault_kv_secret_v2" "argo_user" {
mount = "secret"
name = var.argo_vault_secret_path
}
locals {
argo_secret_access_key = ephemeral.vault_kv_secret_v2.argo_user.data["secretAccessKey"]
}
resource "versitygw_user" "argo" {
access_key_id = var.argo_principal
secret_access_key = local.argo_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "argo" {
bucket = var.argo_bucket_name
}
resource "minio_s3_bucket_policy" "argo" {
bucket = minio_s3_bucket.argo.bucket
depends_on = [
versitygw_user.argo,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "ArgoBucketAccess"
Effect = "Allow"
Principal = var.argo_principal
Action = [
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
]
Resource = [
"arn:aws:s3:::${var.argo_bucket_name}",
]
},
{
Sid = "ArgoObjectAccess"
Effect = "Allow"
Principal = var.argo_principal
Action = [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListMultipartUploadParts",
"s3:PutObject",
"s3:PutObjectAcl",
]
Resource = [
"arn:aws:s3:::${var.argo_bucket_name}/*",
]
},
]
})
}

130
terraform/internal/versitygw/artifacts.tf Normal file
View file

@ -0,0 +1,130 @@
ephemeral "vault_kv_secret_v2" "mc_publisher" {
mount = "secret"
name = "versitygw/users/mc-publisher"
}
ephemeral "vault_kv_secret_v2" "minecraft" {
mount = "secret"
name = "versitygw/users/minecraft"
}
ephemeral "vault_kv_secret_v2" "boot_publisher" {
mount = "secret"
name = "versitygw/users/boot-publisher"
}
resource "versitygw_user" "boot_publisher" {
access_key_id = "********"
secret_access_key = ephemeral.vault_kv_secret_v2.boot_publisher.data["secretAccessKey"]
role = "user"
}
resource "versitygw_user" "minecraft" {
access_key_id = "********"
secret_access_key = ephemeral.vault_kv_secret_v2.minecraft.data["secretAccessKey"]
role = "user"
}
resource "versitygw_user" "mc_publisher" {
access_key_id = "********"
secret_access_key = ephemeral.vault_kv_secret_v2.mc_publisher.data["secretAccessKey"]
role = "user"
}
ephemeral "vault_kv_secret_v2" "grafana" {
mount = "secret"
name = "versitygw/users/grafana"
}
ephemeral "vault_kv_secret_v2" "model_reader" {
mount = "secret"
name = "versitygw/users/model-reader"
}
resource "versitygw_user" "model_reader" {
access_key_id = "********"
secret_access_key = ephemeral.vault_kv_secret_v2.model_reader.data["secretAccessKey"]
role = "user"
}
ephemeral "vault_kv_secret_v2" "rcon_publisher" {
mount = "secret"
name = "versitygw/users/rcon-publisher"
}
resource "versitygw_user" "rcon_publisher" {
access_key_id = "********"
secret_access_key = ephemeral.vault_kv_secret_v2.rcon_publisher.data["secretAccessKey"]
role = "user"
}
resource "versitygw_user" "grafana" {
access_key_id = "********"
secret_access_key = ephemeral.vault_kv_secret_v2.grafana.data["secretAccessKey"]
role = "user"
}
resource "minio_s3_bucket" "artifacts" {
bucket = "artifacts"
}
resource "minio_s3_bucket_policy" "artifacts" {
bucket = minio_s3_bucket.artifacts.bucket
depends_on = [versitygw_user.grafana, versitygw_user.rcon_publisher, versitygw_user.mc_publisher, versitygw_user.minecraft, versitygw_user.boot_publisher]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "MinecraftRead"
Effect = "Allow"
Principal = "********"
Action = ["s3:GetObject"]
Resource = ["arn:aws:s3:::artifacts/minecraft/*"]
},
{
Sid = "SaltatoryRead"
Effect = "Allow"
Principal = "********"
Action = ["s3:GetObject"]
Resource = ["arn:aws:s3:::artifacts/saltatory/*"]
},
{
Sid = "BootstrapPublish"
Effect = "Allow"
Principal = "********"
Action = ["s3:GetObject", "s3:PutObject"]
Resource = ["arn:aws:s3:::artifacts/minecraft/*"]
},
{
Sid = "McPublish"
Effect = "Allow"
Principal = "********"
Action = ["s3:GetObject", "s3:PutObject"]
Resource = ["arn:aws:s3:::artifacts/saltatory/*"]
},
{
Sid = "GrafanaPluginRead"
Effect = "Allow"
Principal = "********"
Action = ["s3:GetObject"]
Resource = ["arn:aws:s3:::artifacts/grafana-rcon/*"]
},
{
Sid = "FrigateModelRead"
Effect = "Allow"
Principal = versitygw_user.model_reader.access_key_id
Action = ["s3:GetObject"]
Resource = ["arn:aws:s3:::artifacts/frigate/yolov9-t-320.onnx"]
},
{
Sid = "RconPublish"
Effect = "Allow"
Principal = "********"
Action = ["s3:GetObject", "s3:PutObject"]
Resource = ["arn:aws:s3:::artifacts/grafana-rcon/*"]
},
]
})
}

39
terraform/internal/versitygw/backups.tf Normal file
View file

@ -0,0 +1,39 @@
ephemeral "vault_kv_secret_v2" "backup_writer" {
mount = "secret"
name = "versitygw/users/backup-writer"
}
resource "versitygw_user" "backup_writer" {
access_key_id = "backup-writer"
secret_access_key = ephemeral.vault_kv_secret_v2.backup_writer.data["secret_access_key"]
role = "user"
}
resource "minio_s3_bucket" "backups" {
bucket = "backups"
}
resource "minio_s3_bucket_policy" "backups" {
bucket = minio_s3_bucket.backups.bucket
depends_on = [versitygw_user.backup_writer]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "BackupList"
Effect = "Allow"
Principal = "backup-writer"
Action = ["s3:GetBucketLocation", "s3:ListBucket"]
Resource = ["arn:aws:s3:::backups"]
},
{
Sid = "BackupData"
Effect = "Allow"
Principal = "backup-writer"
Action = ["s3:AbortMultipartUpload", "s3:GetObject", "s3:PutObject"]
Resource = ["arn:aws:s3:::backups/*"]
},
]
})
}

55
terraform/internal/versitygw/canary.tf Normal file
View file

@ -0,0 +1,55 @@
ephemeral "vault_kv_secret_v2" "canary_user" {
mount = "secret"
name = var.canary_vault_secret_path
}
locals {
canary_secret_access_key = ephemeral.vault_kv_secret_v2.canary_user.data["secretAccessKey"]
}
resource "versitygw_user" "canary" {
access_key_id = var.canary_principal
secret_access_key = local.canary_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "canary" {
bucket = var.canary_bucket_name
}
resource "minio_s3_bucket_policy" "canary" {
bucket = minio_s3_bucket.canary.bucket
depends_on = [
versitygw_user.canary,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "CanaryBucketReadWrite"
Effect = "Allow"
Principal = var.canary_principal
Action = [
"s3:ListBucket",
]
Resource = [
"arn:aws:s3:::${var.canary_bucket_name}",
]
},
{
Sid = "CanaryObjectReadWrite"
Effect = "Allow"
Principal = var.canary_principal
Action = [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
]
Resource = [
"arn:aws:s3:::${var.canary_bucket_name}/*",
]
},
]
})
}

13
terraform/internal/versitygw/dev.tfrc Normal file
View file

@ -0,0 +1,13 @@
# Module-local OpenTofu CLI config for using the local VersityGW provider mirror.
# Run OpenTofu from terraform/internal/versitygw with:
# TF_CLI_CONFIG_FILE=dev.tfrc tofu init
provider_installation {
filesystem_mirror {
path = "../../../packages/versitygw-terraform-provider/dist"
include = ["registry.opentofu.org/quorate/versitygw"]
}
direct {
exclude = ["registry.opentofu.org/quorate/versitygw"]
}
}

35
terraform/internal/versitygw/dump.tf Normal file
View file

@ -0,0 +1,35 @@
ephemeral "vault_kv_secret_v2" "dump_hardware_qualification_writer" {
mount = "secret"
name = var.dump_hardware_qualification_writer_vault_secret_path
}
resource "versitygw_user" "dump_hardware_qualification_writer" {
access_key_id = var.dump_hardware_qualification_writer_principal
secret_access_key = ephemeral.vault_kv_secret_v2.dump_hardware_qualification_writer.data["secretAccessKey"]
role = "user"
}
resource "minio_s3_bucket" "dump" {
bucket = var.dump_bucket_name
}
resource "minio_s3_bucket_policy" "dump" {
bucket = minio_s3_bucket.dump.bucket
depends_on = [
versitygw_user.dump_hardware_qualification_writer,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "HardwareQualificationWrite"
Effect = "Allow"
Principal = var.dump_hardware_qualification_writer_principal
Action = ["s3:PutObject"]
Resource = ["arn:aws:s3:::${var.dump_bucket_name}/hardware-qualification/*"]
},
]
})
}

63
terraform/internal/versitygw/forgejo-public.tf Normal file
View file

@ -0,0 +1,63 @@
ephemeral "vault_kv_secret_v2" "forgejo_public_user" {
mount = "secret"
name = var.forgejo_public_vault_secret_path
}
locals {
forgejo_public_secret_access_key = ephemeral.vault_kv_secret_v2.forgejo_public_user.data["secretAccessKey"]
}
resource "versitygw_user" "forgejo_public" {
access_key_id = var.forgejo_public_principal
secret_access_key = local.forgejo_public_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "forgejo_public" {
bucket = var.forgejo_public_bucket_name
}
resource "minio_s3_bucket_policy" "forgejo_public" {
bucket = minio_s3_bucket.forgejo_public.bucket
depends_on = [
versitygw_user.forgejo_public,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "ForgejoPublicBucketAccess"
Effect = "Allow"
Principal = var.forgejo_public_principal
Action = [
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
]
Resource = [
"arn:aws:s3:::${var.forgejo_public_bucket_name}",
]
},
{
Sid = "ForgejoPublicObjectAccess"
Effect = "Allow"
Principal = var.forgejo_public_principal
Action = [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListMultipartUploadParts",
"s3:PutObject",
"s3:PutObjectAcl",
]
Resource = [
"arn:aws:s3:::${var.forgejo_public_bucket_name}/*",
]
},
]
})
}

63
terraform/internal/versitygw/forgejo.tf Normal file
View file

@ -0,0 +1,63 @@
ephemeral "vault_kv_secret_v2" "forgejo_user" {
mount = "secret"
name = var.forgejo_vault_secret_path
}
locals {
forgejo_secret_access_key = ephemeral.vault_kv_secret_v2.forgejo_user.data["secretAccessKey"]
}
resource "versitygw_user" "forgejo" {
access_key_id = var.forgejo_principal
secret_access_key = local.forgejo_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "forgejo" {
bucket = var.forgejo_bucket_name
}
resource "minio_s3_bucket_policy" "forgejo" {
bucket = minio_s3_bucket.forgejo.bucket
depends_on = [
versitygw_user.forgejo,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "ForgejoBucketAccess"
Effect = "Allow"
Principal = var.forgejo_principal
Action = [
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
]
Resource = [
"arn:aws:s3:::${var.forgejo_bucket_name}",
]
},
{
Sid = "ForgejoObjectAccess"
Effect = "Allow"
Principal = var.forgejo_principal
Action = [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListMultipartUploadParts",
"s3:PutObject",
"s3:PutObjectAcl",
]
Resource = [
"arn:aws:s3:::${var.forgejo_bucket_name}/*",
]
},
]
})
}

34
terraform/internal/versitygw/outputs.tf Normal file
View file

@ -0,0 +1,34 @@
output "canary_bucket_name" {
description = "Canary bucket managed by Terraform."
value = minio_s3_bucket.canary.bucket
}
output "s3_endpoint" {
description = "VersityGW S3 endpoint used by this module."
value = var.s3_endpoint
}
output "canary_access_key_id" {
description = "Canary user access key ID."
value = versitygw_user.canary.access_key_id
}
output "terraform_state_bucket_name" {
description = "OpenTofu remote state bucket managed by Terraform."
value = minio_s3_bucket.terraform_state.bucket
}
output "terraform_state_access_key_id" {
description = "OpenTofu remote state user access key ID."
value = versitygw_user.terraform_state.access_key_id
}
output "dump_bucket_name" {
description = "Raw data dump bucket managed by Terraform."
value = minio_s3_bucket.dump.bucket
}
output "dump_hardware_qualification_writer_access_key_id" {
description = "Hardware qualification writer access key ID."
value = versitygw_user.dump_hardware_qualification_writer.access_key_id
}

57
terraform/internal/versitygw/pg-backup.tf Normal file
View file

@ -0,0 +1,57 @@
ephemeral "vault_kv_secret_v2" "pg_backup" {
mount = "secret"
name = "versitygw/users/pg-backup"
}
resource "versitygw_user" "pg_backup" {
access_key_id = "********"
secret_access_key = ephemeral.vault_kv_secret_v2.pg_backup.data["secret_access_key"]
role = "user"
}
resource "minio_s3_bucket" "pg_backup" {
bucket = "pg-backup"
}
resource "minio_s3_bucket_policy" "pg_backup" {
bucket = minio_s3_bucket.pg_backup.bucket
depends_on = [versitygw_user.pg_backup]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "PostgresBackupList"
Effect = "Allow"
Principal = "pg-backup"
Action = [
"s3:GetBucketLocation",
"s3:ListBucket",
]
Resource = ["arn:aws:s3:::pg-backup"]
},
{
Sid = "PostgresBackupData"
Effect = "Allow"
Principal = "pg-backup"
Action = [
"s3:AbortMultipartUpload",
"s3:GetObject",
"s3:PutObject",
]
Resource = ["arn:aws:s3:::pg-backup/*"]
},
{
Sid = "PostgresBackupDelete"
Effect = "Allow"
Principal = "pg-backup"
Action = ["s3:DeleteObject"]
Resource = [
"arn:aws:s3:::pg-backup",
"arn:aws:s3:::pg-backup/*",
]
},
]
})
}

82
terraform/internal/versitygw/project-delivery.tf Normal file
View file

@ -0,0 +1,82 @@
ephemeral "vault_kv_secret_v2" "project_delivery_cache_reader" {
mount = "secret"
name = var.project_delivery_cache_reader_vault_secret_path
}
ephemeral "vault_kv_secret_v2" "project_delivery_cache_writer" {
mount = "secret"
name = var.project_delivery_cache_writer_vault_secret_path
}
resource "versitygw_user" "project_delivery_cache_reader" {
access_key_id = var.project_delivery_cache_reader_principal
secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_reader.data["secretAccessKey"]
role = "user"
}
resource "versitygw_user" "project_delivery_cache_writer" {
access_key_id = var.project_delivery_cache_writer_principal
secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_writer.data["secretAccessKey"]
role = "user"
}
resource "minio_s3_bucket" "project_delivery" {
bucket = var.project_delivery_cache_bucket_name
}
resource "minio_s3_bucket_policy" "project_delivery" {
bucket = minio_s3_bucket.project_delivery.bucket
depends_on = [
versitygw_user.project_delivery_cache_reader,
versitygw_user.project_delivery_cache_writer,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "ProjectDeliveryCacheLocation"
Effect = "Allow"
Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
Action = ["s3:GetBucketLocation"]
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
},
{
Sid = "ProjectDeliveryCacheList"
Effect = "Allow"
Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
Action = [
"s3:ListBucket",
]
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
Condition = {
StringLike = {
"s3:prefix" = ["projects/*"]
}
}
},
{
Sid = "ProjectDeliveryCacheRead"
Effect = "Allow"
Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
Action = ["s3:GetObject"]
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
},
{
Sid = "ProjectDeliveryCacheWrite"
Effect = "Allow"
Principal = var.project_delivery_cache_writer_principal
Action = ["s3:PutObject"]
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
},
{
Sid = "ProjectDeliveryCachePrune"
Effect = "Allow"
Principal = var.project_delivery_cache_writer_principal
Action = ["s3:DeleteObject"]
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*/*/cache/*/objects/*"]
},
]
})
}

49
terraform/internal/versitygw/providers.tf Normal file
View file

@ -0,0 +1,49 @@
terraform {
required_version = "< 2.0.0"
backend "pg" {
conn_str = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
schema_name = "internal_versitygw"
}
required_providers {
minio = {
source = "aminueza/minio"
version = "~> 3.30"
}
versitygw = {
source = "quorate/versitygw"
version = "0.0.1"
}
vault = {
source = "hashicorp/vault"
version = "~> 5.0"
}
}
}
provider "vault" {}
ephemeral "vault_kv_secret_v2" "versitygw_root" {
mount = "secret"
name = var.root_vault_secret_path
}
locals {
root_access_key_id = ephemeral.vault_kv_secret_v2.versitygw_root.data[var.root_access_key_id_key]
root_secret_access_key = ephemeral.vault_kv_secret_v2.versitygw_root.data[var.root_secret_access_key_key]
}
provider "versitygw" {
endpoint = var.admin_endpoint
region = var.region
admin_access_key = local.root_access_key_id
admin_secret_key = local.root_secret_access_key
}
provider "minio" {
minio_server = var.minio_server
minio_region = var.region
minio_user = local.root_access_key_id
minio_password = local.root_secret_access_key
minio_ssl = var.minio_ssl
}

63
terraform/internal/versitygw/quay.tf Normal file
View file

@ -0,0 +1,63 @@
ephemeral "vault_kv_secret_v2" "quay_user" {
mount = "secret"
name = var.quay_vault_secret_path
}
locals {
quay_secret_access_key = ephemeral.vault_kv_secret_v2.quay_user.data["secretAccessKey"]
}
resource "versitygw_user" "quay" {
access_key_id = var.quay_principal
secret_access_key = local.quay_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "quay_registry" {
bucket = var.quay_bucket_name
}
resource "minio_s3_bucket_policy" "quay_registry" {
bucket = minio_s3_bucket.quay_registry.bucket
depends_on = [
versitygw_user.quay,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "QuayBucketAccess"
Effect = "Allow"
Principal = var.quay_principal
Action = [
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
]
Resource = [
"arn:aws:s3:::${var.quay_bucket_name}",
]
},
{
Sid = "QuayObjectAccess"
Effect = "Allow"
Principal = var.quay_principal
Action = [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListMultipartUploadParts",
"s3:PutObject",
"s3:PutObjectAcl",
]
Resource = [
"arn:aws:s3:::${var.quay_bucket_name}/*",
]
},
]
})
}

60
terraform/internal/versitygw/stalwart.tf Normal file
View file

@ -0,0 +1,60 @@
ephemeral "vault_kv_secret_v2" "stalwart_user" {
mount = "secret"
name = var.stalwart_vault_secret_path
}
locals {
stalwart_secret_access_key = ephemeral.vault_kv_secret_v2.stalwart_user.data["secretAccessKey"]
}
resource "versitygw_user" "stalwart" {
access_key_id = var.stalwart_principal
secret_access_key = local.stalwart_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "stalwart" {
bucket = var.stalwart_bucket_name
}
resource "minio_s3_bucket_policy" "stalwart" {
bucket = minio_s3_bucket.stalwart.bucket
depends_on = [
versitygw_user.stalwart,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "StalwartBucketAccess"
Effect = "Allow"
Principal = var.stalwart_principal
Action = [
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
]
Resource = [
"arn:aws:s3:::${var.stalwart_bucket_name}",
]
},
{
Sid = "StalwartObjectAccess"
Effect = "Allow"
Principal = var.stalwart_principal
Action = [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:ListMultipartUploadParts",
"s3:PutObject",
]
Resource = [
"arn:aws:s3:::${var.stalwart_bucket_name}/*",
]
},
]
})
}

55
terraform/internal/versitygw/state.tf Normal file
View file

@ -0,0 +1,55 @@
ephemeral "vault_kv_secret_v2" "terraform_state_user" {
mount = "secret"
name = var.terraform_state_vault_secret_path
}
locals {
terraform_state_secret_access_key = ephemeral.vault_kv_secret_v2.terraform_state_user.data["secretAccessKey"]
}
resource "versitygw_user" "terraform_state" {
access_key_id = var.terraform_state_principal
secret_access_key = local.terraform_state_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "terraform_state" {
bucket = var.terraform_state_bucket_name
}
resource "minio_s3_bucket_policy" "terraform_state" {
bucket = minio_s3_bucket.terraform_state.bucket
depends_on = [
versitygw_user.terraform_state,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "TerraformStateBucketList"
Effect = "Allow"
Principal = var.terraform_state_principal
Action = [
"s3:ListBucket",
]
Resource = [
"arn:aws:s3:::${var.terraform_state_bucket_name}",
]
},
{
Sid = "TerraformStateObjectReadWrite"
Effect = "Allow"
Principal = var.terraform_state_principal
Action = [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
]
Resource = [
"arn:aws:s3:::${var.terraform_state_bucket_name}/*",
]
},
]
})
}

239
terraform/internal/versitygw/variables.tf Normal file
View file

@ -0,0 +1,239 @@
variable "region" {
description = "Region string advertised by VersityGW."
type = string
default = "us-east-1"
}
variable "s3_endpoint" {
description = "VersityGW S3 API endpoint."
type = string
default = "https://s3.quorate.internal"
}
variable "admin_endpoint" {
description = "VersityGW admin API endpoint."
type = string
default = "https://s3-admin.quorate.internal"
}
variable "minio_server" {
description = "VersityGW S3 endpoint host[:port] for the MinIO-compatible Terraform provider."
type = string
default = "s3.quorate.internal"
}
variable "minio_ssl" {
description = "Use TLS when connecting to VersityGW through the MinIO-compatible Terraform provider."
type = bool
default = true
}
variable "canary_bucket_name" {
description = "Initial bucket used to prove VersityGW bucket and policy compatibility."
type = string
default = "canary"
}
variable "canary_principal" {
description = "VersityGW user/access key ID allowed to exercise the canary bucket."
type = string
default = "canary"
}
variable "canary_vault_secret_path" {
description = "Vault KV v2 secret path containing the canary VersityGW secretAccessKey."
type = string
default = "versitygw/users/canary"
}
variable "root_vault_secret_path" {
description = "Vault KV v2 secret path containing the VersityGW root/admin credentials."
type = string
default = "versitygw/root"
}
variable "root_access_key_id_key" {
description = "Key in root_vault_secret_path containing the VersityGW root/admin access key ID."
type = string
default = "rootAccessKeyId"
}
variable "root_secret_access_key_key" {
description = "Key in root_vault_secret_path containing the VersityGW root/admin secret access key."
type = string
default = "rootSecretAccessKey"
}
variable "terraform_state_bucket_name" {
description = "Bucket used for OpenTofu remote state."
type = string
default = "terraform-state"
}
variable "terraform_state_principal" {
description = "VersityGW user/access key ID allowed to read and write OpenTofu remote state."
type = string
default = "terraform-state"
}
variable "terraform_state_vault_secret_path" {
description = "Vault KV v2 secret path containing the Terraform state user secretAccessKey."
type = string
default = "versitygw/users/terraform-state"
}
variable "quay_bucket_name" {
description = "Bucket used by Quay for live registry blob storage."
type = string
default = "quay-registry"
}
variable "quay_principal" {
description = "VersityGW user/access key ID allowed to use the Quay registry bucket."
type = string
default = "quay"
}
variable "quay_vault_secret_path" {
description = "Vault KV v2 secret path containing the Quay VersityGW secretAccessKey."
type = string
default = "versitygw/users/quay"
}
variable "forgejo_bucket_name" {
description = "Bucket used by Forgejo for attachments and avatars."
type = string
default = "forgejo"
}
variable "forgejo_principal" {
description = "VersityGW user/access key ID allowed to use the Forgejo bucket."
type = string
default = "forgejo"
}
variable "forgejo_vault_secret_path" {
description = "Vault KV v2 secret path containing the Forgejo VersityGW secretAccessKey."
type = string
default = "versitygw/users/forgejo"
}
variable "forgejo_public_bucket_name" {
description = "Bucket used by public Forgejo for attachments and avatars."
type = string
default = "forgejo-public"
}
variable "forgejo_public_principal" {
description = "VersityGW user/access key ID allowed to use the public Forgejo bucket."
type = string
default = "forgejo-public"
}
variable "forgejo_public_vault_secret_path" {
description = "Vault KV v2 secret path containing the public Forgejo VersityGW secretAccessKey."
type = string
default = "versitygw/users/forgejo-public"
}
variable "zot_bucket_name" {
description = "Bucket used by Zot for bootstrap registry blob storage."
type = string
default = "zot"
}
variable "zot_principal" {
description = "VersityGW user/access key ID allowed to use the Zot bootstrap registry bucket."
type = string
default = "zot"
}
variable "zot_vault_secret_path" {
description = "Vault KV v2 secret path containing the Zot VersityGW secretAccessKey."
type = string
default = "versitygw/users/zot"
}
variable "argo_bucket_name" {
description = "Bucket used by Argo Workflows for workflow artifacts and optional log archive."
type = string
default = "argo-workflows"
}
variable "argo_principal" {
description = "VersityGW user/access key ID allowed to use the Argo artifacts bucket."
type = string
default = "argo"
}
variable "argo_vault_secret_path" {
description = "Vault KV v2 secret path containing the Argo VersityGW secretAccessKey."
type = string
default = "versitygw/users/argo"
}
variable "project_delivery_cache_bucket_name" {
description = "Bucket used by project delivery build caches."
type = string
default = "project-delivery"
}
variable "project_delivery_cache_reader_principal" {
description = "VersityGW user allowed to read project delivery build caches."
type = string
default = "project-delivery-cache-reader"
}
variable "project_delivery_cache_reader_vault_secret_path" {
description = "Vault KV v2 secret path containing the project delivery cache reader secretAccessKey."
type = string
default = "versitygw/users/project-delivery-cache-reader"
}
variable "project_delivery_cache_writer_principal" {
description = "VersityGW user allowed to inspect and write project delivery build caches."
type = string
default = "project-delivery-cache-writer"
}
variable "project_delivery_cache_writer_vault_secret_path" {
description = "Vault KV v2 secret path containing the project delivery cache writer secretAccessKey."
type = string
default = "versitygw/users/project-delivery-cache-writer"
}
variable "dump_bucket_name" {
description = "Bucket used for non-sensitive raw data."
type = string
default = "dump"
}
variable "dump_hardware_qualification_writer_principal" {
description = "VersityGW user allowed to write hardware qualification data."
type = string
default = "hardware-qualification-writer"
}
variable "dump_hardware_qualification_writer_vault_secret_path" {
description = "Vault KV v2 secret path containing the hardware qualification writer secretAccessKey."
type = string
default = "versitygw/users/hardware-qualification-writer"
}
variable "stalwart_bucket_name" {
description = "Bucket used by Stalwart for message bodies and attachments."
type = string
default = "stalwart"
}
variable "stalwart_principal" {
description = "VersityGW user/access key ID allowed to use the Stalwart bucket."
type = string
default = "stalwart"
}
variable "stalwart_vault_secret_path" {
description = "Vault KV v2 secret path containing the Stalwart VersityGW secretAccessKey."
type = string
default = "versitygw/users/stalwart"
}

54
terraform/internal/versitygw/zot.tf Normal file
View file

@ -0,0 +1,54 @@
ephemeral "vault_kv_secret_v2" "zot_user" {
mount = "secret"
name = var.zot_vault_secret_path
}
locals {
zot_secret_access_key = ephemeral.vault_kv_secret_v2.zot_user.data["secretAccessKey"]
}
resource "versitygw_user" "zot" {
access_key_id = var.zot_principal
secret_access_key = local.zot_secret_access_key
role = "user"
}
resource "minio_s3_bucket" "zot" {
bucket = var.zot_bucket_name
}
resource "minio_s3_bucket_policy" "zot" {
bucket = minio_s3_bucket.zot.bucket
depends_on = [
versitygw_user.zot,
]
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "ZotBucketAccess"
Effect = "Allow"
Principal = var.zot_principal
Action = [
"s3:*",
]
Resource = [
"arn:aws:s3:::${var.zot_bucket_name}",
]
},
{
Sid = "ZotObjectAccess"
Effect = "Allow"
Principal = var.zot_principal
Action = [
"s3:*",
]
Resource = [
"arn:aws:s3:::${var.zot_bucket_name}/*",
]
},
]
})
}