187 lines
6.9 KiB
HCL
187 lines
6.9 KiB
HCL
locals {
|
|
account_login_uri = "${trim(var.stalwart_account_webui_base_url, "/")}/account/oauth/callback"
|
|
account_logout_uri = "${trim(var.stalwart_account_webui_base_url, "/")}/account/oauth/logout"
|
|
stalwart_zitadel_roles = {
|
|
stalwart_admin = {
|
|
display_name = "Stalwart administrator"
|
|
group = "Stalwart"
|
|
}
|
|
stalwart_controller = {
|
|
display_name = "Stalwart configuration controller"
|
|
group = "Stalwart"
|
|
}
|
|
stalwart_submitter = {
|
|
display_name = "Stalwart alert submitter"
|
|
group = "Stalwart"
|
|
}
|
|
stalwart_notifier = {
|
|
display_name = "Stalwart notification sender"
|
|
group = "Stalwart"
|
|
}
|
|
stalwart_test = {
|
|
display_name = "Stalwart authenticated client test"
|
|
group = "Stalwart"
|
|
}
|
|
}
|
|
|
|
stalwart_zitadel_role_keys = keys(local.stalwart_zitadel_roles)
|
|
}
|
|
|
|
resource "zitadel_application_oidc" "stalwart_account_webui" {
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.stalwart.id
|
|
name = "Mail app passwords"
|
|
redirect_uris = [local.account_login_uri]
|
|
response_types = ["OIDC_RESPONSE_TYPE_CODE"]
|
|
grant_types = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE"]
|
|
post_logout_redirect_uris = [local.account_logout_uri]
|
|
app_type = "OIDC_APP_TYPE_USER_AGENT"
|
|
auth_method_type = "OIDC_AUTH_METHOD_TYPE_NONE"
|
|
version = "OIDC_VERSION_1_0"
|
|
clock_skew = "0s"
|
|
dev_mode = false
|
|
access_token_type = "OIDC_TOKEN_TYPE_BEARER"
|
|
access_token_role_assertion = true
|
|
id_token_role_assertion = true
|
|
id_token_userinfo_assertion = true
|
|
}
|
|
|
|
resource "zitadel_project" "stalwart" {
|
|
org_id = zitadel_org.primary.id
|
|
name = var.stalwart_project_name
|
|
project_role_assertion = true
|
|
project_role_check = true
|
|
has_project_check = true
|
|
private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED"
|
|
}
|
|
|
|
resource "zitadel_project_role" "stalwart" {
|
|
for_each = local.stalwart_zitadel_roles
|
|
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.stalwart.id
|
|
role_key = each.key
|
|
display_name = each.value.display_name
|
|
group = each.value.group
|
|
}
|
|
|
|
resource "zitadel_machine_user" "stalwart_controller" {
|
|
org_id = zitadel_org.primary.id
|
|
user_name = "stalwart-controller"
|
|
name = "Stalwart configuration controller"
|
|
description = "Credentialless Stalwart desired-state owner"
|
|
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
|
with_secret = true
|
|
}
|
|
|
|
resource "zitadel_machine_user" "stalwart_sender" {
|
|
org_id = zitadel_org.primary.id
|
|
user_name = "stalwart-submitter"
|
|
name = "Stalwart alert sender"
|
|
description = "Zitadel-owned Stalwart cluster-local SMTP identity"
|
|
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
|
with_secret = true
|
|
}
|
|
|
|
resource "zitadel_machine_user" "stalwart_notifier" {
|
|
org_id = zitadel_org.primary.id
|
|
user_name = "stalwart-notifier"
|
|
name = "Stalwart notification sender"
|
|
description = "Zitadel-owned Stalwart notification identity"
|
|
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
|
with_secret = true
|
|
}
|
|
|
|
resource "zitadel_machine_user" "stalwart_test" {
|
|
org_id = zitadel_org.primary.id
|
|
user_name = "stalwart-test-client"
|
|
name = "Stalwart authenticated client test"
|
|
description = "Zitadel-owned authenticated mail client test identity"
|
|
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
|
|
with_secret = true
|
|
}
|
|
|
|
resource "zitadel_user_grant" "stalwart_admin" {
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.stalwart.id
|
|
user_id = var.stalwart_admin_zitadel_user_id
|
|
role_keys = ["stalwart_admin"]
|
|
|
|
depends_on = [zitadel_project_role.stalwart]
|
|
}
|
|
|
|
resource "zitadel_user_grant" "stalwart_controller" {
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.stalwart.id
|
|
user_id = zitadel_machine_user.stalwart_controller.id
|
|
role_keys = ["stalwart_controller"]
|
|
|
|
depends_on = [zitadel_project_role.stalwart]
|
|
}
|
|
|
|
resource "zitadel_user_grant" "stalwart_sender" {
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.stalwart.id
|
|
user_id = zitadel_machine_user.stalwart_sender.id
|
|
role_keys = ["stalwart_submitter"]
|
|
|
|
depends_on = [zitadel_project_role.stalwart]
|
|
}
|
|
|
|
resource "zitadel_user_grant" "stalwart_notifier" {
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.stalwart.id
|
|
user_id = zitadel_machine_user.stalwart_notifier.id
|
|
role_keys = ["stalwart_notifier"]
|
|
|
|
depends_on = [zitadel_project_role.stalwart]
|
|
}
|
|
|
|
resource "zitadel_user_grant" "stalwart_test" {
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.stalwart.id
|
|
user_id = zitadel_machine_user.stalwart_test.id
|
|
role_keys = ["stalwart_test"]
|
|
|
|
depends_on = [zitadel_project_role.stalwart]
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "stalwart_oidc" {
|
|
mount = var.vault_kv_mount
|
|
name = var.stalwart_oidc_vault_path
|
|
|
|
data_json = jsonencode({
|
|
account_client_id = zitadel_application_oidc.stalwart_account_webui.client_id
|
|
audience = zitadel_project.stalwart.id
|
|
client_id = zitadel_machine_user.stalwart_controller.client_id
|
|
client_secret = zitadel_machine_user.stalwart_controller.client_secret
|
|
controller_subject = zitadel_machine_user.stalwart_controller.id
|
|
human_admin_subject = var.stalwart_admin_zitadel_user_id
|
|
issuer_url = "https://${var.zitadel_domain}"
|
|
notifier_client_id = zitadel_machine_user.stalwart_notifier.client_id
|
|
notifier_client_secret = zitadel_machine_user.stalwart_notifier.client_secret
|
|
notifier_subject = zitadel_machine_user.stalwart_notifier.id
|
|
sender_client_id = zitadel_machine_user.stalwart_sender.client_id
|
|
sender_client_secret = zitadel_machine_user.stalwart_sender.client_secret
|
|
sender_subject = zitadel_machine_user.stalwart_sender.id
|
|
test_client_id = zitadel_machine_user.stalwart_test.client_id
|
|
test_client_secret = zitadel_machine_user.stalwart_test.client_secret
|
|
test_subject = zitadel_machine_user.stalwart_test.id
|
|
})
|
|
}
|
|
|
|
data "vault_kv_secret_v2" "stalwart_zitadel_notification" {
|
|
mount = var.vault_kv_mount
|
|
name = var.stalwart_zitadel_notification_vault_path
|
|
}
|
|
|
|
resource "zitadel_email_provider_smtp" "stalwart" {
|
|
sender_address = "[email protected]"
|
|
sender_name = "Quorate"
|
|
host = "stalwart-submission.stalwart.svc.cluster.local:587"
|
|
tls = false
|
|
user = "[email protected]"
|
|
password = data.vault_kv_secret_v2.stalwart_zitadel_notification.data["smtp_password"]
|
|
description = "Stalwart cluster-local notification submission"
|
|
set_active = true
|
|
}
|