Initial commit

modules/app-database/locals.tf

@@ -0,0 +1,5 @@
+locals {
+  databases = var.service.database == null ? {} : {
+    (var.service.database.name) = var.service.database
+  }
+}

modules/app-database/main.tf

@@ -0,0 +1,42 @@
+resource "random_password" "this" {
+  for_each = local.databases
+  length   = 32
+  special  = false
+}
+
+resource "postgresql_role" "this" {
+  for_each = local.databases
+  name     = each.value.username
+  login    = true
+  password = random_password.this[each.key].result
+}
+
+resource "postgresql_database" "this" {
+  for_each = local.databases
+  name     = each.key
+  owner    = postgresql_role.this[each.key].name
+}
+
+resource "postgresql_extension" "vector" {
+  for_each = { for key, value in local.databases : key => value if value.pgvector }
+  name     = "vector"
+  database = postgresql_database.this[each.key].name
+}
+
+resource "postgresql_grant" "public" {
+  for_each    = postgresql_database.this
+  database    = each.value.name
+  role        = "public"
+  object_type = "database"
+  privileges  = []
+}
+
+resource "postgresql_grant" "owner" {
+  for_each    = postgresql_database.this
+  database    = each.value.name
+  role        = postgresql_role.this[each.key].name
+  object_type = "database"
+  privileges  = ["CONNECT", "CREATE", "TEMPORARY"]
+
+  depends_on = [postgresql_grant.public]
+}

modules/app-database/output.tf

@@ -0,0 +1,9 @@
+output "credentials" {
+  value = one([for name, db in postgresql_database.this : {
+    database = db.name
+    username = postgresql_role.this[name].name
+    password = random_password.this[name].result
+  }])
+  description = "credentials of the service database, null if the service has no database"
+  sensitive   = true
+}

modules/app-database/variables.tf

@@ -0,0 +1,10 @@
+variable "service" {
+  type = object({
+    name = string
+    database = optional(object({
+      name     = string
+      username = string
+      pgvector = optional(bool, false)
+    }))
+  })
+}

modules/app-database/versions.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    postgresql = {
+      source  = "cyrilgdn/postgresql"
+      version = ">= 1.27.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.9.1"
+    }
+  }
+}