ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/zitadel/quay_personas.tf

@@ -0,0 +1,46 @@
+locals {
+  quay_personas = {
+    candidates-bot = {
+      display_name = "Quay Candidates Bot"
+      email        = "[email protected]"
+      last_name    = "Candidates"
+    }
+    mirror-bot = {
+      display_name = "Quay Mirror Bot"
+      email        = "[email protected]"
+      last_name    = "Mirror"
+    }
+  }
+}
+
+ephemeral "vault_kv_secret_v2" "quay_persona" {
+  for_each = local.quay_personas
+
+  mount = var.vault_kv_mount
+  name  = "quay/personas/${each.key}"
+}
+
+resource "zitadel_human_user" "quay_persona" {
+  for_each = local.quay_personas
+
+  org_id                       = zitadel_org.primary.id
+  user_name                    = each.key
+  first_name                   = "Quay"
+  last_name                    = each.value.last_name
+  display_name                 = each.value.display_name
+  email                        = each.value.email
+  is_email_verified            = true
+  initial_password             = ephemeral.vault_kv_secret_v2.quay_persona[each.key].data["password"]
+  initial_skip_password_change = true
+}
+
+resource "zitadel_user_grant" "quay_persona" {
+  for_each = local.quay_personas
+
+  org_id     = zitadel_org.primary.id
+  project_id = zitadel_project.services.id
+  user_id    = zitadel_human_user.quay_persona[each.key].id
+  role_keys  = ["quay_user"]
+
+  depends_on = [zitadel_project_role.quay]
+}