63 lines
1.6 KiB
HCL
63 lines
1.6 KiB
HCL
ephemeral "vault_kv_secret_v2" "forgejo_public_user" {
|
|
mount = "secret"
|
|
name = var.forgejo_public_vault_secret_path
|
|
}
|
|
|
|
locals {
|
|
forgejo_public_secret_access_key = ephemeral.vault_kv_secret_v2.forgejo_public_user.data["secretAccessKey"]
|
|
}
|
|
|
|
resource "versitygw_user" "forgejo_public" {
|
|
access_key_id = var.forgejo_public_principal
|
|
secret_access_key = local.forgejo_public_secret_access_key
|
|
role = "user"
|
|
}
|
|
|
|
resource "minio_s3_bucket" "forgejo_public" {
|
|
bucket = var.forgejo_public_bucket_name
|
|
}
|
|
|
|
resource "minio_s3_bucket_policy" "forgejo_public" {
|
|
bucket = minio_s3_bucket.forgejo_public.bucket
|
|
|
|
depends_on = [
|
|
versitygw_user.forgejo_public,
|
|
]
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Sid = "ForgejoPublicBucketAccess"
|
|
Effect = "Allow"
|
|
Principal = var.forgejo_public_principal
|
|
Action = [
|
|
"s3:GetBucketAcl",
|
|
"s3:GetBucketLocation",
|
|
"s3:ListBucket",
|
|
"s3:ListBucketMultipartUploads",
|
|
]
|
|
Resource = [
|
|
"arn:aws:s3:::${var.forgejo_public_bucket_name}",
|
|
]
|
|
},
|
|
{
|
|
Sid = "ForgejoPublicObjectAccess"
|
|
Effect = "Allow"
|
|
Principal = var.forgejo_public_principal
|
|
Action = [
|
|
"s3:AbortMultipartUpload",
|
|
"s3:DeleteObject",
|
|
"s3:GetObject",
|
|
"s3:GetObjectAcl",
|
|
"s3:ListMultipartUploadParts",
|
|
"s3:PutObject",
|
|
"s3:PutObjectAcl",
|
|
]
|
|
Resource = [
|
|
"arn:aws:s3:::${var.forgejo_public_bucket_name}/*",
|
|
]
|
|
},
|
|
]
|
|
})
|
|
}
|