100 lines
3.6 KiB
HCL
100 lines
3.6 KiB
HCL
data "terraform_remote_state" "postgres" {
|
|
backend = "pg"
|
|
config = {
|
|
conn_str = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
|
|
schema_name = "internal_postgres"
|
|
}
|
|
}
|
|
|
|
resource "vault_mount" "database" {
|
|
path = "database"
|
|
type = "database"
|
|
}
|
|
|
|
resource "vault_database_secret_backend_connection" "postgres" {
|
|
backend = vault_mount.database.path
|
|
name = "postgres"
|
|
allowed_roles = ["zitadel", "forgejo", "forgejo-public", "grafana", "quay", "quay_clair", "argo", "stalwart", "tf-state", "hf-chat-ui"]
|
|
|
|
postgresql {
|
|
connection_url = "postgresql://{{username}}:{{password}}@main-rw.postgres.svc.cluster.local:5432/postgres?sslmode=require"
|
|
username = "********"
|
|
password = data.terraform_remote_state.postgres.outputs.vault_db_admin_password
|
|
}
|
|
}
|
|
|
|
locals {
|
|
db_static_rotation_schedule = "0 19 * * 0"
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "zitadel" {
|
|
backend = vault_mount.database.path
|
|
name = "zitadel"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "forgejo" {
|
|
backend = vault_mount.database.path
|
|
name = "forgejo"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "forgejo_public" {
|
|
backend = vault_mount.database.path
|
|
name = "forgejo-public"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "grafana" {
|
|
backend = vault_mount.database.path
|
|
name = "grafana"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "quay" {
|
|
backend = vault_mount.database.path
|
|
name = "quay"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "quay_clair" {
|
|
backend = vault_mount.database.path
|
|
name = "quay_clair"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "argo" {
|
|
backend = vault_mount.database.path
|
|
name = "argo"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "stalwart" {
|
|
backend = vault_mount.database.path
|
|
name = "stalwart"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|
|
|
|
resource "vault_database_secret_backend_static_role" "tf_state" {
|
|
backend = vault_mount.database.path
|
|
name = "tf-state"
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
|
username = "********"
|
|
rotation_schedule = local.db_static_rotation_schedule
|
|
}
|