++ minio host configurable in yaml, incluster runner

.gitea/workflows/terraform.yml

@@ -38,7 +38,7 @@ env:
 
 jobs:
   validate:
-    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    runs-on: ${{ vars.RUNNER_LABEL || 'incluster' }}
     container:
       image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
     env:
@@ -88,7 +88,7 @@ jobs:
 
   plan:
     needs: [validate]
-    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    runs-on: ${{ vars.RUNNER_LABEL || 'incluster' }}
     container:
       image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
     env:
@@ -137,7 +137,7 @@ jobs:
   apply:
     needs: [plan]
     if: github.event_name == 'push'
-    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    runs-on: ${{ vars.RUNNER_LABEL || 'incluster' }}
     container:
       image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
     env:

infrastructure.yaml

@@ -15,6 +15,11 @@ environments:
         annotations:
           managed-by: terraform
 
+    # MinIO endpoint (declarative). Exposed externally on this contour; scheme
+    # decides TLS. Admin creds are injected from Vault (secrets/minio/admin).
+    minio:
+      endpoint: https://minio.contour.infra.sarex.tech
+
     # In-cluster MinIO. Bucket + dedicated access user (access_key/secret_key).
     buckets:
       - name: test-bucket

live/s3/terragrunt.hcl

@@ -45,4 +45,9 @@ terraform {
 
 inputs = {
   buckets = try(local.env_config.buckets, [])
+
+  # MinIO endpoint is declarative (infrastructure.yaml); admin creds come from Vault.
+  minio_endpoint = try(local.env_config.minio.endpoint, "http://minio.minio.svc.cluster.local:9000")
+  minio_user     = get_env("MINIO_ADMIN_USER", "")
+  minio_password = get_env("MINIO_ADMIN_PASSWORD", "")
 }

live/secrets/terragrunt.hcl

@@ -122,7 +122,7 @@ inputs = {
 
   # In-cluster constants (contour). No managed-YC CA; in-cluster pgbouncer/pg on 5432.
   constants = {
-    s3_endpoint   = get_env("MINIO_PUBLIC_ENDPOINT", "http://minio.minio.svc.cluster.local:9000")
+    s3_endpoint   = try(local.infra_config.environments[local.env_name].minio.endpoint, "http://minio.minio.svc.cluster.local:9000")
     postgres_port = "5432"
     postgres_ca   = ""
     valkey_port   = "6379"

live/terragrunt.hcl

@@ -94,12 +94,8 @@ provider "kafka" {
 # RabbitMQ provider is configured INSIDE modules/rabbitmq (from its management_*
 # inputs), so it is intentionally NOT generated here to avoid a duplicate config.
 
-# In-cluster MinIO S3 API. Admin from Vault secrets/minio/admin.
-provider "minio" {
-  minio_server   = "${get_env("MINIO_ENDPOINT", "minio.minio.svc.cluster.local:9000")}"
-  minio_user     = "${get_env("MINIO_ADMIN_USER", "")}"
-  minio_password = "${get_env("MINIO_ADMIN_PASSWORD", "")}"
-  minio_ssl      = false
-}
+# MinIO provider is configured INSIDE modules/minio-buckets (endpoint from
+# infrastructure.yaml, admin creds from Vault via the s3 unit), so it is not
+# generated here.
 EOF_PROVIDER
 }

modules/minio-buckets/main.tf

@@ -1,3 +1,18 @@
+# Self-configured MinIO provider (like modules/rabbitmq): the endpoint comes from
+# infrastructure.yaml, so the host is declarative; admin creds are injected from
+# Vault via the s3 unit. Scheme in minio_endpoint decides TLS.
+locals {
+  minio_ssl    = can(regex("^https://", var.minio_endpoint))
+  minio_server = replace(replace(trimsuffix(var.minio_endpoint, "/"), "https://", ""), "http://", "")
+}
+
+provider "minio" {
+  minio_server   = local.minio_server
+  minio_user     = var.minio_user
+  minio_password = var.minio_password
+  minio_ssl      = local.minio_ssl
+}
+
 # In-cluster MinIO implementation of the `buckets` entity contract. Per bucket:
 # create the bucket, a dedicated access user (access_key/secret_key) and a policy
 # granting that user full access to only its bucket — mirroring yc-s3, which
@@ -63,6 +78,6 @@ resource "minio_iam_policy" "this" {
 resource "minio_iam_user_policy_attachment" "this" {
   for_each = local.buckets_map
 
-  user_name  = minio_iam_user.this[each.key].name
+  user_name   = minio_iam_user.this[each.key].name
   policy_name = minio_iam_policy.this[each.key].name
 }

modules/minio-buckets/variables.tf

@@ -28,3 +28,21 @@ variable "user_suffix" {
   type        = string
   default     = "-sa"
 }
+
+variable "minio_endpoint" {
+  description = "MinIO S3 endpoint URL (scheme decides ssl). E.g. https://minio.contour.infra.sarex.tech"
+  type        = string
+}
+
+variable "minio_user" {
+  description = "MinIO admin access key."
+  type        = string
+  default     = ""
+}
+
+variable "minio_password" {
+  description = "MinIO admin secret key."
+  type        = string
+  default     = ""
+  sensitive   = true
+}

scripts/load_admin_creds.sh

@@ -12,7 +12,7 @@ set -eu
 
 _kv() {
   # $1=path $2=key -> value on stdout; loud diagnostic to stderr on http error
-  _code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" || echo 000)
+  _code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1") || true
   if [ "$_code" != "200" ]; then
     echo "load_admin_creds: cannot read secrets/$1 (http ${_code}) — check VAULT_TOKEN policy and VAULT_ADDR" >&2
     printf ''