ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
259
terraform/internal/zitadel/variables.tf
Normal file
259
terraform/internal/zitadel/variables.tf
Normal file
|
|
@ -0,0 +1,259 @@
|
|||
variable "zitadel_org_name" {
|
||||
description = "Name of the primary service organization to create in ZITADEL."
|
||||
type = string
|
||||
default = "Quorate"
|
||||
}
|
||||
|
||||
variable "zitadel_org_id" {
|
||||
description = "Optional stable custom ID for the primary service organization. Leave null to let ZITADEL generate one."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "zitadel_project_name" {
|
||||
description = "Name of the ZITADEL project that groups service clients."
|
||||
type = string
|
||||
default = "Services"
|
||||
}
|
||||
|
||||
variable "forgejo_base_url" {
|
||||
description = "Canonical Forgejo URL. This must match the Forgejo HTTPRoute hostname and ROOT_URL."
|
||||
type = string
|
||||
default = "https://forge.quorate.internal"
|
||||
}
|
||||
|
||||
variable "forgejo_oauth_provider_name" {
|
||||
description = "Forgejo OAuth2 authentication source name; this value is part of the callback URL."
|
||||
type = string
|
||||
default = "Zitadel"
|
||||
}
|
||||
|
||||
variable "vault_kv_mount" {
|
||||
description = "Vault KV v2 mount where generated service integration secrets are mirrored."
|
||||
type = string
|
||||
default = "secret"
|
||||
}
|
||||
|
||||
variable "forgejo_oidc_vault_path" {
|
||||
description = "Vault KV path for Forgejo's ZITADEL OIDC client material."
|
||||
type = string
|
||||
default = "forgejo/oidc/zitadel"
|
||||
}
|
||||
|
||||
variable "stalwart_oidc_vault_path" {
|
||||
description = "Vault KV path containing Stalwart's ZITADEL resource-server metadata."
|
||||
type = string
|
||||
default = "stalwart/oidc/zitadel"
|
||||
}
|
||||
|
||||
variable "stalwart_zitadel_notification_vault_path" {
|
||||
description = "Vault KV path containing Stalwart's ZITADEL notification SMTP credentials."
|
||||
type = string
|
||||
default = "stalwart/zitadel-notification"
|
||||
}
|
||||
|
||||
variable "stalwart_project_name" {
|
||||
description = "Name of the dedicated ZITADEL project for Stalwart tokens."
|
||||
type = string
|
||||
default = "Stalwart"
|
||||
}
|
||||
|
||||
variable "stalwart_admin_zitadel_user_id" {
|
||||
description = "ZITADEL human user ID granted Stalwart administrative access."
|
||||
type = string
|
||||
default = "********"
|
||||
}
|
||||
|
||||
variable "forgejo_public_base_url" {
|
||||
description = "Canonical authenticated URL for the public Forgejo database."
|
||||
type = string
|
||||
default = "https://git.quorate.dev"
|
||||
}
|
||||
|
||||
variable "forgejo_public_oauth_provider_name" {
|
||||
description = "Public Forgejo OAuth2 authentication source name."
|
||||
type = string
|
||||
default = "Zitadel"
|
||||
}
|
||||
|
||||
variable "forgejo_public_oidc_vault_path" {
|
||||
description = "Vault KV path for public Forgejo's ZITADEL OIDC client material."
|
||||
type = string
|
||||
default = "forgejo-public/oidc/zitadel"
|
||||
}
|
||||
|
||||
variable "service_admin_zitadel_user_id" {
|
||||
description = "ZITADEL human user ID granted administrative access to GitOps-managed service applications."
|
||||
type = string
|
||||
default = "********"
|
||||
}
|
||||
|
||||
variable "service_admin_zitadel_role_keys" {
|
||||
description = "Service project role keys assigned to service_admin_zitadel_user_id."
|
||||
type = set(string)
|
||||
default = [
|
||||
"forgejo_admin",
|
||||
"frigate_admin",
|
||||
"grafana_admin",
|
||||
"longhorn_admin",
|
||||
"quay_admin",
|
||||
]
|
||||
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for role_key in var.service_admin_zitadel_role_keys : contains([
|
||||
"forgejo_user",
|
||||
"forgejo_admin",
|
||||
"forgejo_restricted",
|
||||
"frigate_viewer",
|
||||
"frigate_admin",
|
||||
"grafana_viewer",
|
||||
"grafana_editor",
|
||||
"grafana_admin",
|
||||
"longhorn_admin",
|
||||
"quay_user",
|
||||
"quay_admin",
|
||||
], role_key)
|
||||
])
|
||||
error_message = "Service admin ZITADEL grants may only use known Forgejo, Frigate, Grafana, Longhorn, and Quay role keys."
|
||||
}
|
||||
}
|
||||
|
||||
variable "frigate_base_url" {
|
||||
description = "Canonical Frigate URL. This must match the Frigate HTTPRoute hostname and oauth2-proxy redirect URL."
|
||||
type = string
|
||||
default = "https://frigate.quorate.internal"
|
||||
}
|
||||
|
||||
variable "frigate_zitadel_user_grants" {
|
||||
description = "Map of ZITADEL user IDs to Frigate role keys to grant. Valid role keys are frigate_viewer and frigate_admin."
|
||||
type = map(set(string))
|
||||
default = {}
|
||||
|
||||
validation {
|
||||
condition = alltrue(flatten([
|
||||
for _, role_keys in var.frigate_zitadel_user_grants : [
|
||||
for role_key in role_keys : contains([
|
||||
"frigate_viewer",
|
||||
"frigate_admin",
|
||||
], role_key)
|
||||
]
|
||||
]))
|
||||
error_message = "Frigate ZITADEL grants may only use frigate_viewer and frigate_admin."
|
||||
}
|
||||
}
|
||||
|
||||
variable "forgejo_zitadel_user_grants" {
|
||||
description = "Map of ZITADEL user IDs to Forgejo role keys to grant. Valid role keys are forgejo_user, forgejo_admin, and forgejo_restricted."
|
||||
type = map(set(string))
|
||||
default = {}
|
||||
|
||||
validation {
|
||||
condition = alltrue(flatten([
|
||||
for _, role_keys in var.forgejo_zitadel_user_grants : [
|
||||
for role_key in role_keys : contains([
|
||||
"forgejo_user",
|
||||
"forgejo_admin",
|
||||
"forgejo_restricted",
|
||||
], role_key)
|
||||
]
|
||||
]))
|
||||
error_message = "Forgejo ZITADEL grants may only use forgejo_user, forgejo_admin, and forgejo_restricted."
|
||||
}
|
||||
}
|
||||
|
||||
variable "grafana_base_url" {
|
||||
description = "Canonical Grafana URL. This must match the Grafana HTTPRoute hostname and root URL."
|
||||
type = string
|
||||
default = "https://grafana.quorate.internal"
|
||||
}
|
||||
|
||||
variable "grafana_oidc_vault_path" {
|
||||
description = "Vault KV path for Grafana's ZITADEL OIDC client material."
|
||||
type = string
|
||||
default = "grafana/oidc/zitadel"
|
||||
}
|
||||
|
||||
variable "grafana_zitadel_user_grants" {
|
||||
description = "Map of ZITADEL user IDs to Grafana role keys to grant. Valid role keys are grafana_viewer, grafana_editor, and grafana_admin."
|
||||
type = map(set(string))
|
||||
default = {}
|
||||
|
||||
validation {
|
||||
condition = alltrue(flatten([
|
||||
for _, role_keys in var.grafana_zitadel_user_grants : [
|
||||
for role_key in role_keys : contains([
|
||||
"grafana_viewer",
|
||||
"grafana_editor",
|
||||
"grafana_admin",
|
||||
], role_key)
|
||||
]
|
||||
]))
|
||||
error_message = "Grafana ZITADEL grants may only use grafana_viewer, grafana_editor, and grafana_admin."
|
||||
}
|
||||
}
|
||||
|
||||
variable "longhorn_base_url" {
|
||||
description = "Canonical Longhorn URL. This must match the Longhorn HTTPRoute hostname and oauth2-proxy redirect URL."
|
||||
type = string
|
||||
default = "https://longhorn.quorate.internal"
|
||||
}
|
||||
|
||||
variable "stalwart_account_webui_base_url" {
|
||||
description = "Public Stalwart account WebUI base URL."
|
||||
type = string
|
||||
default = "https://mail.quorate.dev"
|
||||
}
|
||||
|
||||
variable "longhorn_oauth2_proxy_vault_path" {
|
||||
description = "Vault KV path for Longhorn's oauth2-proxy OIDC client material."
|
||||
type = string
|
||||
default = "longhorn/oauth2-proxy"
|
||||
}
|
||||
|
||||
variable "longhorn_zitadel_user_grants" {
|
||||
description = "Map of ZITADEL user IDs to Longhorn role keys to grant. Valid role key is longhorn_admin."
|
||||
type = map(set(string))
|
||||
default = {}
|
||||
|
||||
validation {
|
||||
condition = alltrue(flatten([
|
||||
for _, role_keys in var.longhorn_zitadel_user_grants : [
|
||||
for role_key in role_keys : contains([
|
||||
"longhorn_admin",
|
||||
], role_key)
|
||||
]
|
||||
]))
|
||||
error_message = "Longhorn ZITADEL grants may only use longhorn_admin."
|
||||
}
|
||||
}
|
||||
|
||||
variable "quay_base_url" {
|
||||
description = "Canonical Quay URL. This must match the Quay HTTPRoute hostname and SERVER_HOSTNAME."
|
||||
type = string
|
||||
default = "https://registry.quorate.internal"
|
||||
}
|
||||
|
||||
variable "quay_oidc_vault_path" {
|
||||
description = "Vault KV path for Quay's ZITADEL OIDC client material."
|
||||
type = string
|
||||
default = "quay/oidc/zitadel"
|
||||
}
|
||||
|
||||
variable "quay_zitadel_user_grants" {
|
||||
description = "Map of ZITADEL user IDs to Quay role keys to grant. Valid role keys are quay_user and quay_admin."
|
||||
type = map(set(string))
|
||||
default = {}
|
||||
|
||||
validation {
|
||||
condition = alltrue(flatten([
|
||||
for _, role_keys in var.quay_zitadel_user_grants : [
|
||||
for role_key in role_keys : contains([
|
||||
"quay_user",
|
||||
"quay_admin",
|
||||
], role_key)
|
||||
]
|
||||
]))
|
||||
error_message = "Quay ZITADEL grants may only use quay_user and quay_admin."
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue