84 lines
2.5 KiB
Terraform
84 lines
2.5 KiB
Terraform
module "database" {
|
|
source = "../modules/database"
|
|
for_each = module.config.databases
|
|
name = each.key
|
|
owner = each.value.owner
|
|
pgvector = each.value.pgvector
|
|
}
|
|
|
|
module "database_access" {
|
|
source = "../modules/database-access"
|
|
for_each = module.config.service_databases
|
|
role = each.value.role
|
|
owner = module.database[each.value.database].owner
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "postgres" {
|
|
for_each = module.config.service_databases
|
|
mount = module.config.vault.mount
|
|
name = "${each.value.service}/postgres/${each.value.database}"
|
|
delete_all_versions = true
|
|
data_json = jsonencode({
|
|
host = module.config.postgres.internal_host
|
|
port = module.config.postgres.internal_port
|
|
database = module.database[each.value.database].name
|
|
username = module.database_access[each.key].username
|
|
password = module.database_access[each.key].password
|
|
sslmode = module.config.postgres.sslmode
|
|
})
|
|
}
|
|
|
|
resource "random_password" "vault" {
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "postgresql_role" "vault" {
|
|
name = "vault"
|
|
login = true
|
|
create_role = true
|
|
password = random_password.vault.result
|
|
|
|
lifecycle {
|
|
ignore_changes = [roles]
|
|
}
|
|
}
|
|
|
|
resource "postgresql_grant_role" "vault" {
|
|
for_each = module.database
|
|
role = postgresql_role.vault.name
|
|
grant_role = each.value.owner
|
|
with_admin_option = true
|
|
}
|
|
|
|
resource "vault_database_secrets_mount" "postgres" {
|
|
path = module.config.vault.database_mount
|
|
|
|
postgresql {
|
|
name = "postgres"
|
|
connection_url = "postgresql://{{username}}:{{password}}@${module.config.postgres.internal_host}:${module.config.postgres.internal_port}/postgres?sslmode=${module.config.postgres.sslmode}"
|
|
username = postgresql_role.vault.name
|
|
password = random_password.vault.result
|
|
allowed_roles = keys(module.config.service_databases)
|
|
}
|
|
}
|
|
|
|
resource "vault_database_secret_backend_role" "service" {
|
|
for_each = module.config.service_databases
|
|
backend = vault_database_secrets_mount.postgres.path
|
|
name = each.key
|
|
db_name = vault_database_secrets_mount.postgres.postgresql[0].name
|
|
|
|
creation_statements = [
|
|
"CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}' IN ROLE \"${each.value.owner}\";",
|
|
"ALTER ROLE \"{{name}}\" SET role = \"${each.value.owner}\";",
|
|
]
|
|
revocation_statements = [
|
|
"DROP ROLE IF EXISTS \"{{name}}\";",
|
|
]
|
|
default_ttl = 3600
|
|
max_ttl = 86400
|
|
|
|
depends_on = [postgresql_grant_role.vault]
|
|
}
|