Initial commit

storage/main.tf

@@ -0,0 +1,66 @@
+resource "minio_s3_bucket" "state_terraform_s3" {
+  bucket = module.config.silo.state_bucket
+  acl    = "private"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "minio_s3_bucket_versioning" "state_terraform_s3" {
+  bucket = minio_s3_bucket.state_terraform_s3.bucket
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "minio_ilm_policy" "admin_policy" {
+  bucket = minio_s3_bucket.state_terraform_s3.bucket
+
+  rule {
+    id     = "clean-rule-1"
+    status = "Enabled"
+    noncurrent_expiration {
+      days = "90d"
+    }
+    expired_object_delete_marker = true
+    abort_incomplete_multipart_upload {
+      days_after_initiation = "6d"
+    }
+  }
+}
+
+resource "minio_s3_bucket" "backups" {
+  bucket = module.config.silo.backup_bucket
+  acl    = "private"
+}
+
+resource "minio_ilm_policy" "backups" {
+  bucket = minio_s3_bucket.backups.bucket
+
+  rule {
+    id         = "expire-old-backups"
+    status     = "Enabled"
+    expiration = "30d"
+  }
+}
+
+module "app_storage" {
+  source   = "../modules/app-storage"
+  for_each = local.services_with_buckets
+  service  = { name = each.key, buckets = each.value.buckets }
+}
+
+resource "vault_kv_secret_v2" "s3" {
+  for_each            = module.app_storage
+  mount               = module.config.vault.mount
+  name                = "${each.key}/s3"
+  delete_all_versions = true
+  data_json = jsonencode({
+    endpoint   = module.config.silo.internal_endpoint
+    buckets    = join(",", each.value.buckets)
+    access_key = each.value.access_key
+    secret_key = each.value.secret_key
+  })
+}