ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/versitygw/artifacts.tf

@@ -0,0 +1,130 @@
+ephemeral "vault_kv_secret_v2" "mc_publisher" {
+  mount = "secret"
+  name  = "versitygw/users/mc-publisher"
+}
+
+ephemeral "vault_kv_secret_v2" "minecraft" {
+  mount = "secret"
+  name  = "versitygw/users/minecraft"
+}
+
+ephemeral "vault_kv_secret_v2" "boot_publisher" {
+  mount = "secret"
+  name  = "versitygw/users/boot-publisher"
+}
+
+resource "versitygw_user" "boot_publisher" {
+  access_key_id     = "********"
+  secret_access_key = ephemeral.vault_kv_secret_v2.boot_publisher.data["secretAccessKey"]
+  role              = "user"
+}
+
+resource "versitygw_user" "minecraft" {
+  access_key_id     = "********"
+  secret_access_key = ephemeral.vault_kv_secret_v2.minecraft.data["secretAccessKey"]
+  role              = "user"
+}
+
+resource "versitygw_user" "mc_publisher" {
+  access_key_id     = "********"
+  secret_access_key = ephemeral.vault_kv_secret_v2.mc_publisher.data["secretAccessKey"]
+  role              = "user"
+}
+
+ephemeral "vault_kv_secret_v2" "grafana" {
+  mount = "secret"
+  name  = "versitygw/users/grafana"
+}
+
+ephemeral "vault_kv_secret_v2" "model_reader" {
+  mount = "secret"
+  name  = "versitygw/users/model-reader"
+}
+
+resource "versitygw_user" "model_reader" {
+  access_key_id     = "********"
+  secret_access_key = ephemeral.vault_kv_secret_v2.model_reader.data["secretAccessKey"]
+  role              = "user"
+}
+
+ephemeral "vault_kv_secret_v2" "rcon_publisher" {
+  mount = "secret"
+  name  = "versitygw/users/rcon-publisher"
+}
+
+resource "versitygw_user" "rcon_publisher" {
+  access_key_id     = "********"
+  secret_access_key = ephemeral.vault_kv_secret_v2.rcon_publisher.data["secretAccessKey"]
+  role              = "user"
+}
+
+resource "versitygw_user" "grafana" {
+  access_key_id     = "********"
+  secret_access_key = ephemeral.vault_kv_secret_v2.grafana.data["secretAccessKey"]
+  role              = "user"
+}
+
+resource "minio_s3_bucket" "artifacts" {
+  bucket = "artifacts"
+}
+
+resource "minio_s3_bucket_policy" "artifacts" {
+  bucket = minio_s3_bucket.artifacts.bucket
+
+  depends_on = [versitygw_user.grafana, versitygw_user.rcon_publisher, versitygw_user.mc_publisher, versitygw_user.minecraft, versitygw_user.boot_publisher]
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "MinecraftRead"
+        Effect    = "Allow"
+        Principal = "********"
+        Action    = ["s3:GetObject"]
+        Resource  = ["arn:aws:s3:::artifacts/minecraft/*"]
+      },
+      {
+        Sid       = "SaltatoryRead"
+        Effect    = "Allow"
+        Principal = "********"
+        Action    = ["s3:GetObject"]
+        Resource  = ["arn:aws:s3:::artifacts/saltatory/*"]
+      },
+      {
+        Sid       = "BootstrapPublish"
+        Effect    = "Allow"
+        Principal = "********"
+        Action    = ["s3:GetObject", "s3:PutObject"]
+        Resource  = ["arn:aws:s3:::artifacts/minecraft/*"]
+      },
+      {
+        Sid       = "McPublish"
+        Effect    = "Allow"
+        Principal = "********"
+        Action    = ["s3:GetObject", "s3:PutObject"]
+        Resource  = ["arn:aws:s3:::artifacts/saltatory/*"]
+      },
+      {
+        Sid       = "GrafanaPluginRead"
+        Effect    = "Allow"
+        Principal = "********"
+        Action    = ["s3:GetObject"]
+        Resource  = ["arn:aws:s3:::artifacts/grafana-rcon/*"]
+      },
+      {
+        Sid       = "FrigateModelRead"
+        Effect    = "Allow"
+        Principal = versitygw_user.model_reader.access_key_id
+        Action    = ["s3:GetObject"]
+        Resource  = ["arn:aws:s3:::artifacts/frigate/yolov9-t-320.onnx"]
+      },
+      {
+        Sid       = "RconPublish"
+        Effect    = "Allow"
+        Principal = "********"
+        Action    = ["s3:GetObject", "s3:PutObject"]
+        Resource  = ["arn:aws:s3:::artifacts/grafana-rcon/*"]
+      },
+    ]
+  })
+}