ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/zitadel/quay.tf

@@ -0,0 +1,67 @@
+locals {
+  quay_oidc_redirect_uri = "${trim(var.quay_base_url, "/")}/oauth2/zitadel/callback"
+  quay_oidc_redirect_uris = [
+    local.quay_oidc_redirect_uri,
+    "${local.quay_oidc_redirect_uri}/attach",
+    "${local.quay_oidc_redirect_uri}/cli",
+  ]
+
+  quay_zitadel_roles = {
+    quay_user = {
+      display_name = "Quay user"
+      group        = "Quay"
+    }
+    quay_admin = {
+      display_name = "Quay administrator"
+      group        = "Quay"
+    }
+  }
+
+  quay_zitadel_role_keys = keys(local.quay_zitadel_roles)
+}
+
+resource "zitadel_project_role" "quay" {
+  for_each = local.quay_zitadel_roles
+
+  org_id       = zitadel_org.primary.id
+  project_id   = zitadel_project.services.id
+  role_key     = each.key
+  display_name = each.value.display_name
+  group        = each.value.group
+}
+
+resource "zitadel_application_oidc" "quay" {
+  org_id                       = zitadel_org.primary.id
+  project_id                   = zitadel_project.services.id
+  name                         = "Quay"
+  redirect_uris                = local.quay_oidc_redirect_uris
+  response_types               = ["OIDC_RESPONSE_TYPE_CODE"]
+  grant_types                  = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
+  post_logout_redirect_uris    = [trim(var.quay_base_url, "/")]
+  app_type                     = "OIDC_APP_TYPE_WEB"
+  auth_method_type             = "OIDC_AUTH_METHOD_TYPE_BASIC"
+  version                      = "OIDC_VERSION_1_0"
+  clock_skew                   = "0s"
+  dev_mode                     = false
+  access_token_type            = "OIDC_TOKEN_TYPE_BEARER"
+  access_token_role_assertion  = false
+  id_token_role_assertion      = true
+  id_token_userinfo_assertion  = true
+  additional_origins           = []
+  skip_native_app_success_page = false
+}
+
+resource "vault_kv_secret_v2" "quay_oidc" {
+  mount = var.vault_kv_mount
+  name  = var.quay_oidc_vault_path
+
+  data_json = jsonencode({
+    client_id     = zitadel_application_oidc.quay.client_id
+    client_secret = zitadel_application_oidc.quay.client_secret
+    discovery_url = "https://${var.zitadel_domain}/.well-known/openid-configuration"
+    redirect_uri  = local.quay_oidc_redirect_uri
+  })
+
+  # Vault is source of truth after first write. OIDC credential rotation is explicit.
+  lifecycle { ignore_changes = [data_json] }
+}