ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
187
terraform/internal/zitadel/stalwart.tf
Normal file
187
terraform/internal/zitadel/stalwart.tf
Normal file
|
|
@ -0,0 +1,187 @@
|
|||
locals {
|
||||
account_login_uri = "${trim(var.stalwart_account_webui_base_url, "/")}/account/oauth/callback"
|
||||
account_logout_uri = "${trim(var.stalwart_account_webui_base_url, "/")}/account/oauth/logout"
|
||||
stalwart_zitadel_roles = {
|
||||
stalwart_admin = {
|
||||
display_name = "Stalwart administrator"
|
||||
group = "Stalwart"
|
||||
}
|
||||
stalwart_controller = {
|
||||
display_name = "Stalwart configuration controller"
|
||||
group = "Stalwart"
|
||||
}
|
||||
stalwart_submitter = {
|
||||
display_name = "Stalwart alert submitter"
|
||||
group = "Stalwart"
|
||||
}
|
||||
stalwart_notifier = {
|
||||
display_name = "Stalwart notification sender"
|
||||
group = "Stalwart"
|
||||
}
|
||||
stalwart_test = {
|
||||
display_name = "Stalwart authenticated client test"
|
||||
group = "Stalwart"
|
||||
}
|
||||
}
|
||||
|
||||
stalwart_zitadel_role_keys = keys(local.stalwart_zitadel_roles)
|
||||
}
|
||||
|
||||
resource "zitadel_application_oidc" "stalwart_account_webui" {
|
||||
org_id = zitadel_org.primary.id
|
||||
project_id = zitadel_project.stalwart.id
|
||||
name = "Mail app passwords"
|
||||
redirect_uris = [local.account_login_uri]
|
||||
response_types = ["OIDC_RESPONSE_TYPE_CODE"]
|
||||
grant_types = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE"]
|
||||
post_logout_redirect_uris = [local.account_logout_uri]
|
||||
app_type = "OIDC_APP_TYPE_USER_AGENT"
|
||||
auth_method_type = "OIDC_AUTH_METHOD_TYPE_NONE"
|
||||
version = "OIDC_VERSION_1_0"
|
||||
clock_skew = "0s"
|
||||
dev_mode = false
|
||||
access_token_type = "OIDC_TOKEN_TYPE_BEARER"
|
||||
access_token_role_assertion = true
|
||||
id_token_role_assertion = true
|
||||
id_token_userinfo_assertion = true
|
||||
}
|
||||
|
||||
resource "zitadel_project" "stalwart" {
|
||||
org_id = zitadel_org.primary.id
|
||||
name = var.stalwart_project_name
|
||||
project_role_assertion = true
|
||||
project_role_check = true
|
||||
has_project_check = true
|
||||
private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED"
|
||||
}
|
||||
|
||||
resource "zitadel_project_role" "stalwart" {
|
||||
for_each = local.stalwart_zitadel_roles
|
||||
|
||||
org_id = zitadel_org.primary.id
|
||||
project_id = zitadel_project.stalwart.id
|
||||
role_key = each.key
|
||||
display_name = each.value.display_name
|
||||
group = each.value.group
|
||||
}
|
||||
|
||||
resource "zitadel_machine_user" "stalwart_controller" {
|
||||
org_id = zitadel_org.primary.id
|
||||
user_name = "stalwart-controller"
|
||||
name = "Stalwart configuration controller"
|
||||
description = "Credentialless Stalwart desired-state owner"
|
||||
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
||||
with_secret = true
|
||||
}
|
||||
|
||||
resource "zitadel_machine_user" "stalwart_sender" {
|
||||
org_id = zitadel_org.primary.id
|
||||
user_name = "stalwart-submitter"
|
||||
name = "Stalwart alert sender"
|
||||
description = "Zitadel-owned Stalwart cluster-local SMTP identity"
|
||||
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
||||
with_secret = true
|
||||
}
|
||||
|
||||
resource "zitadel_machine_user" "stalwart_notifier" {
|
||||
org_id = zitadel_org.primary.id
|
||||
user_name = "stalwart-notifier"
|
||||
name = "Stalwart notification sender"
|
||||
description = "Zitadel-owned Stalwart notification identity"
|
||||
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
||||
with_secret = true
|
||||
}
|
||||
|
||||
resource "zitadel_machine_user" "stalwart_test" {
|
||||
org_id = zitadel_org.primary.id
|
||||
user_name = "stalwart-test-client"
|
||||
name = "Stalwart authenticated client test"
|
||||
description = "Zitadel-owned authenticated mail client test identity"
|
||||
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
||||
with_secret = true
|
||||
}
|
||||
|
||||
resource "zitadel_user_grant" "stalwart_admin" {
|
||||
org_id = zitadel_org.primary.id
|
||||
project_id = zitadel_project.stalwart.id
|
||||
user_id = var.stalwart_admin_zitadel_user_id
|
||||
role_keys = ["stalwart_admin"]
|
||||
|
||||
depends_on = [zitadel_project_role.stalwart]
|
||||
}
|
||||
|
||||
resource "zitadel_user_grant" "stalwart_controller" {
|
||||
org_id = zitadel_org.primary.id
|
||||
project_id = zitadel_project.stalwart.id
|
||||
user_id = zitadel_machine_user.stalwart_controller.id
|
||||
role_keys = ["stalwart_controller"]
|
||||
|
||||
depends_on = [zitadel_project_role.stalwart]
|
||||
}
|
||||
|
||||
resource "zitadel_user_grant" "stalwart_sender" {
|
||||
org_id = zitadel_org.primary.id
|
||||
project_id = zitadel_project.stalwart.id
|
||||
user_id = zitadel_machine_user.stalwart_sender.id
|
||||
role_keys = ["stalwart_submitter"]
|
||||
|
||||
depends_on = [zitadel_project_role.stalwart]
|
||||
}
|
||||
|
||||
resource "zitadel_user_grant" "stalwart_notifier" {
|
||||
org_id = zitadel_org.primary.id
|
||||
project_id = zitadel_project.stalwart.id
|
||||
user_id = zitadel_machine_user.stalwart_notifier.id
|
||||
role_keys = ["stalwart_notifier"]
|
||||
|
||||
depends_on = [zitadel_project_role.stalwart]
|
||||
}
|
||||
|
||||
resource "zitadel_user_grant" "stalwart_test" {
|
||||
org_id = zitadel_org.primary.id
|
||||
project_id = zitadel_project.stalwart.id
|
||||
user_id = zitadel_machine_user.stalwart_test.id
|
||||
role_keys = ["stalwart_test"]
|
||||
|
||||
depends_on = [zitadel_project_role.stalwart]
|
||||
}
|
||||
|
||||
resource "vault_kv_secret_v2" "stalwart_oidc" {
|
||||
mount = var.vault_kv_mount
|
||||
name = var.stalwart_oidc_vault_path
|
||||
|
||||
data_json = jsonencode({
|
||||
account_client_id = zitadel_application_oidc.stalwart_account_webui.client_id
|
||||
audience = zitadel_project.stalwart.id
|
||||
client_id = zitadel_machine_user.stalwart_controller.client_id
|
||||
client_secret = zitadel_machine_user.stalwart_controller.client_secret
|
||||
controller_subject = zitadel_machine_user.stalwart_controller.id
|
||||
human_admin_subject = var.stalwart_admin_zitadel_user_id
|
||||
issuer_url = "https://${var.zitadel_domain}"
|
||||
notifier_client_id = zitadel_machine_user.stalwart_notifier.client_id
|
||||
notifier_client_secret = zitadel_machine_user.stalwart_notifier.client_secret
|
||||
notifier_subject = zitadel_machine_user.stalwart_notifier.id
|
||||
sender_client_id = zitadel_machine_user.stalwart_sender.client_id
|
||||
sender_client_secret = zitadel_machine_user.stalwart_sender.client_secret
|
||||
sender_subject = zitadel_machine_user.stalwart_sender.id
|
||||
test_client_id = zitadel_machine_user.stalwart_test.client_id
|
||||
test_client_secret = zitadel_machine_user.stalwart_test.client_secret
|
||||
test_subject = zitadel_machine_user.stalwart_test.id
|
||||
})
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "stalwart_zitadel_notification" {
|
||||
mount = var.vault_kv_mount
|
||||
name = var.stalwart_zitadel_notification_vault_path
|
||||
}
|
||||
|
||||
resource "zitadel_email_provider_smtp" "stalwart" {
|
||||
sender_address = "[email protected]"
|
||||
sender_name = "Quorate"
|
||||
host = "stalwart-submission.stalwart.svc.cluster.local:587"
|
||||
tls = false
|
||||
user = "[email protected]"
|
||||
password = data.vault_kv_secret_v2.stalwart_zitadel_notification.data["smtp_password"]
|
||||
description = "Stalwart cluster-local notification submission"
|
||||
set_active = true
|
||||
}
|
||||
Loading…
Reference in a new issue