Initial commit

storage/.terraform.lock.hcl

@@ -0,0 +1,44 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/aminueza/minio" {
+  version     = "3.44.0"
+  constraints = "~> 3.44.0"
+  hashes = [
+    "h1:kNYbcRnleLjMG5M3D9x5Edzvm4KZgNbItsRV19nP+pY=",
+    "zh:25d3b705f6dfcec6144d0d2e1535eaac06045f4e592311c8b13ccb4644855ca1",
+    "zh:2845cd40624a5fbf35cc71e709b817281887c65eb05c68da77e2e7b60ad2f379",
+    "zh:3d4bf825b616dfb01c4a0a9a48066a1d292dbbaf28bb2943a978b20339ed131c",
+    "zh:4346b7c5194621bed62a7ca66ef7ab1f28332aea45c96b7e66abe6ed74db8148",
+    "zh:452ea3862ff67b9ee6c626ce0bfd81e7af46bdcf7d187358edd8e0f262aa1337",
+    "zh:62649e83fd99cbb3ecbe33ea450fd5993b465fc241b607f865c64e2237f1dec8",
+    "zh:674380f7fc61b2aa96690811b352e4c9e410ad2417380782ead57984d673925f",
+    "zh:6d136207a60567c29d9669aee1784acb6ba7249791b37b015acac5881656c804",
+    "zh:7bc076b707f5222a8397a4fe3673feedf6caa1d32ef59b8ea7726c809ec3ba7f",
+    "zh:c5f003ee66a9698a09d5ee2ec6f9df213f230fc06f5803853b6712f3a995b018",
+    "zh:e46d7ccd969f1e5480aa0a2d7cfb7f49d0575696bcceeb69625fe11b8d704338",
+    "zh:e52a57394f23661a236e3578a28bd0656adddc336c2dafe2e7b573703c2b538e",
+    "zh:f40393f8fd1a7e05f39331c7ad9c63b59a3ccc5151598aecb2ea56eb36bc98c4",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "5.12.0"
+  constraints = "5.12.0"
+  hashes = [
+    "h1:NXnrOFre4t8nj7+ZQ3MKIECpDohjMBtHWm2aen75nfU=",
+    "zh:0683ab1870c6ffe78463465fc0954ff18fbbfe16d79dc121e20efb27cd2be850",
+    "zh:0ade50207774b544995066be02cf7e108abe828e089eb646da4c04863cbee702",
+    "zh:2b3360bec8d457a7d19df86bf4576711035785928a9fa307affce10cbeae89fd",
+    "zh:5317888b0e3547341b8434f42bbb8df2d30bdd95cc1bde9a4c7a80d266fe9f6b",
+    "zh:6c0271736ceb08774bebedf424735d92c4fe33b8e4db371cc027cbded0439a2e",
+    "zh:70bb990d22d1ce1ceac2209aee025e0f7deab48d95002aa2b8360d9c86343ea8",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7f33d7bbf145e15542cfc6b1dbeed639d08204802c239c098770c5f507d1e59c",
+    "zh:8ae8ca31d3c9e4b530c80eed12d8debe6fc46b407acb469b33247227aaafbf51",
+    "zh:c61fcc4d714cefee0696e2f8bf715b5826099e405f66acc859e496de688b6a8e",
+    "zh:ceca8db980ae3bd986142903487d75d143edfc5c7cf467da38f3698f717db046",
+    "zh:e1bba3cb6a728e9bf2951139f1e7bae5bec37a37cd4bfebe282e306212a62c4c",
+    "zh:f9765b4aa90e9e4eae03626ebfdfeda54954ec2552267aedce1fb2643f6eb2de",
+  ]
+}

storage/locals.tf

@@ -0,0 +1,13 @@
+locals {
+  config = yamldecode(file("${path.root}/../config.yaml"))
+}
+
+module "config" {
+  source   = "../modules/config"
+  infra    = local.config.infra
+  services = local.config.services
+}
+
+locals {
+  services_with_buckets = { for name, svc in module.config.services : name => svc if length(svc.buckets) > 0 }
+}

storage/main.tf

@@ -0,0 +1,66 @@
+resource "minio_s3_bucket" "state_terraform_s3" {
+  bucket = module.config.silo.state_bucket
+  acl    = "private"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "minio_s3_bucket_versioning" "state_terraform_s3" {
+  bucket = minio_s3_bucket.state_terraform_s3.bucket
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "minio_ilm_policy" "admin_policy" {
+  bucket = minio_s3_bucket.state_terraform_s3.bucket
+
+  rule {
+    id     = "clean-rule-1"
+    status = "Enabled"
+    noncurrent_expiration {
+      days = "90d"
+    }
+    expired_object_delete_marker = true
+    abort_incomplete_multipart_upload {
+      days_after_initiation = "6d"
+    }
+  }
+}
+
+resource "minio_s3_bucket" "backups" {
+  bucket = module.config.silo.backup_bucket
+  acl    = "private"
+}
+
+resource "minio_ilm_policy" "backups" {
+  bucket = minio_s3_bucket.backups.bucket
+
+  rule {
+    id         = "expire-old-backups"
+    status     = "Enabled"
+    expiration = "30d"
+  }
+}
+
+module "app_storage" {
+  source   = "../modules/app-storage"
+  for_each = local.services_with_buckets
+  service  = { name = each.key, buckets = each.value.buckets }
+}
+
+resource "vault_kv_secret_v2" "s3" {
+  for_each            = module.app_storage
+  mount               = module.config.vault.mount
+  name                = "${each.key}/s3"
+  delete_all_versions = true
+  data_json = jsonencode({
+    endpoint   = module.config.silo.internal_endpoint
+    buckets    = join(",", each.value.buckets)
+    access_key = each.value.access_key
+    secret_key = each.value.secret_key
+  })
+}

storage/output.tf

@@ -0,0 +1,4 @@
+output "vault_secrets" {
+  value       = { for name, secret in vault_kv_secret_v2.s3 : name => secret.path }
+  description = "vault paths of the s3 keys of the services"
+}

storage/provider.tf

@@ -0,0 +1,10 @@
+provider "vault" {
+  address = module.config.vault.address
+  token   = var.vault_token
+}
+
+provider "minio" {
+  minio_server   = module.config.silo.server
+  minio_user     = module.config.silo.admin_user
+  minio_password = var.s3_password
+}

storage/variables.tf

@@ -0,0 +1,11 @@
+variable "s3_password" {
+  description = "password of the silo administrator"
+  type        = string
+  sensitive   = true
+}
+
+variable "vault_token" {
+  description = "vault token"
+  type        = string
+  sensitive   = true
+}

storage/versions.tf

@@ -0,0 +1,15 @@
+terraform {
+  required_providers {
+    minio = {
+      source  = "aminueza/minio"
+      version = "3.44.0"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.12.0"
+    }
+  }
+  backend "s3" {
+    key = "storage/terraform.tfstate"
+  }
+}