ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/zitadel/providers.tf

@@ -0,0 +1,61 @@
+terraform {
+  required_version = "< 2.0.0"
+  backend "pg" {
+    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
+    schema_name = "internal_zitadel"
+  }
+
+  required_providers {
+    zitadel = {
+      source  = "zitadel/zitadel"
+      version = "~> 3.4"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.8"
+    }
+  }
+}
+
+# VAULT_ADDR and VAULT_TOKEN are read from the environment.
+provider "vault" {}
+
+provider "random" {}
+
+ephemeral "vault_kv_secret_v2" "zitadel_iam_admin" {
+  mount = var.vault_kv_mount
+  name  = var.zitadel_iam_admin_vault_path
+}
+
+locals {
+  zitadel_iam_admin_machine_key_json = ephemeral.vault_kv_secret_v2.zitadel_iam_admin.data[var.zitadel_iam_admin_machine_key_key]
+}
+
+provider "zitadel" {
+  domain           = var.zitadel_domain
+  port             = "443"
+  insecure         = false
+  jwt_profile_json = local.zitadel_iam_admin_machine_key_json
+}
+
+variable "zitadel_domain" {
+  description = "External DNS name for the ZITADEL instance."
+  type        = string
+  default     = "auth.quorate.dev"
+}
+
+variable "zitadel_iam_admin_vault_path" {
+  description = "Vault KV path containing the ZITADEL IAM admin machine-key JSON."
+  type        = string
+  default     = "zitadel/iam-admin"
+}
+
+variable "zitadel_iam_admin_machine_key_key" {
+  description = "Key in zitadel_iam_admin_vault_path containing the ZITADEL IAM admin machine-key JSON."
+  type        = string
+  default     = "iam-admin.json"
+}