Resources and access

modules/config/output.tf

@@ -2,10 +2,42 @@ output "infra" {
   value = var.infra
 }
 
+output "buckets" {
+  value = var.buckets
+}
+
+output "databases" {
+  value = {
+    for name, db in var.databases : name => merge(db, { owner = "${name}_owner" })
+  }
+}
+
 output "services" {
   value = var.services
 }
 
+output "service_buckets" {
+  value = {
+    for name, svc in var.services : name => {
+      read_write = [for bucket, access in svc.buckets : bucket if access == "rw"]
+      read_only  = [for bucket, access in svc.buckets : bucket if access == "ro"]
+    } if length(svc.buckets) > 0
+  }
+}
+
+output "service_databases" {
+  value = merge([
+    for name, svc in var.services : {
+      for db in svc.databases : "${name}-${db}" => {
+        service  = name
+        database = db
+        role     = "${name}-${db}"
+        owner    = "${db}_owner"
+      }
+    }
+  ]...)
+}
+
 output "vault" {
   value = {
     address        = "http://${var.infra.vault.host}:${var.infra.vault.port}"

modules/config/variables.tf

@@ -7,6 +7,7 @@ variable "infra" {
       port          = number
       internal_host = string
       internal_port = number
+      sslmode       = string
     })
     pgadmin = object({
       image = string
@@ -34,27 +35,78 @@ variable "infra" {
   })
 }
 
+variable "buckets" {
+  type = map(object({
+    versioning      = optional(bool, true)
+    noncurrent_days = optional(number, 30)
+    expire_days     = optional(number)
+  }))
+  default = {}
+
+  validation {
+    condition = alltrue([
+      for name in keys(var.buckets) : can(regex("^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", name))
+    ])
+    error_message = "Имя бакета: 3–63 символа, строчные латинские буквы, цифры, точки и дефисы."
+  }
+
+  validation {
+    condition     = contains(keys(var.buckets), var.infra.silo.backup_bucket)
+    error_message = "Бакет из infra.silo.backup_bucket должен быть описан в buckets."
+  }
+
+  validation {
+    condition     = !contains(keys(var.buckets), var.infra.silo.state_bucket)
+    error_message = "Бакет из infra.silo.state_bucket создаётся отдельно, в buckets его описывать нельзя."
+  }
+}
+
+variable "databases" {
+  type = map(object({
+    pgvector = optional(bool, false)
+  }))
+  default = {}
+
+  validation {
+    condition = alltrue([
+      for name in keys(var.databases) : can(regex("^[a-z_][a-z0-9_]{0,55}$", name))
+    ])
+    error_message = "Имя базы: до 56 символов, строчные латинские буквы, цифры и подчёркивания, не с цифры."
+  }
+}
+
 variable "services" {
   type = map(object({
-    postgres = optional(object({
-      username = string
-      name     = string
-      sslmode  = optional(string, "disable")
-      pgvector = optional(bool, false)
-    }))
-    buckets = optional(map(object({
-      versioning      = optional(bool, true)
-      noncurrent_days = optional(number, 30)
-    })), {})
+    buckets   = optional(map(string), {})
+    databases = optional(list(string), [])
   }))
+  default = {}
 
   validation {
     condition = alltrue(flatten([
-      for svc in values(var.services) : [
-        for name in keys(svc.buckets) :
-        can(regex("^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", name))
-      ]
+      for svc in values(var.services) : [for bucket in keys(svc.buckets) : contains(keys(var.buckets), bucket)]
     ]))
-    error_message = "Имя бакета: 3–63 символа, строчные латинские буквы, цифры, точки и дефисы."
+    error_message = "Сервис ссылается на бакет, которого нет в buckets."
+  }
+
+  validation {
+    condition = alltrue(flatten([
+      for svc in values(var.services) : [for access in values(svc.buckets) : contains(["rw", "ro"], access)]
+    ]))
+    error_message = "Доступ к бакету: rw или ro."
+  }
+
+  validation {
+    condition = alltrue(flatten([
+      for svc in values(var.services) : [for db in svc.databases : contains(keys(var.databases), db)]
+    ]))
+    error_message = "Сервис ссылается на базу, которой нет в databases."
+  }
+
+  validation {
+    condition = alltrue(flatten([
+      for name, svc in var.services : [for db in svc.databases : length("${name}-${db}") <= 63]
+    ]))
+    error_message = "Имя роли <сервис>-<база> длиннее 63 символов."
   }
 }