From a64eee3e4f0c07c885788ec039e7637355936d8f Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Wed, 12 Aug 2026 12:17:38 +0300
Subject: [PATCH] ++ fall back to provider defaults when contour vars are set
 but empty

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 live/terragrunt.hcl | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/live/terragrunt.hcl b/live/terragrunt.hcl
index 513f8ac..7da4066 100644
--- a/live/terragrunt.hcl
+++ b/live/terragrunt.hcl
@@ -7,6 +7,23 @@
 # providers pick them up via get_env, so there is no cross-provider data-source
 # ordering dependency on the vault-secrets stack.
 
+# get_env подставляет дефолт только когда переменная НЕ ЗАДАНА. Воркфлоу
+# маппит vars.* в env: безусловно, поэтому на контуре, где такая переменная
+# в Gitea не заведена, она приходит пустой строкой - дефолт не срабатывает, и
+# незакавыченные поля (port, tls_enabled) рендерятся как "port =" с пустой
+# правой частью, что валит terraform init на Invalid expression.
+locals {
+  pg_host         = get_env("PG_ADMIN_HOST", "") != "" ? get_env("PG_ADMIN_HOST", "") : "postgresql.postgresql.svc.cluster.local"
+  pg_port         = get_env("PG_ADMIN_PORT", "") != "" ? get_env("PG_ADMIN_PORT", "") : "5432"
+  pg_user         = get_env("PG_ADMIN_USER", "") != "" ? get_env("PG_ADMIN_USER", "") : "postgres"
+  kafka_bootstrap = get_env("KAFKA_BOOTSTRAP", "") != "" ? get_env("KAFKA_BOOTSTRAP", "") : "kafka-kafka-contour-controller-0.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
+  kafka_tls       = get_env("KAFKA_TLS_ENABLED", "") != "" ? get_env("KAFKA_TLS_ENABLED", "") : "false"
+  kafka_mechanism = get_env("KAFKA_SASL_MECHANISM", "") != "" ? get_env("KAFKA_SASL_MECHANISM", "") : "plain"
+  kafka_user      = get_env("KAFKA_ADMIN_USER", "") != "" ? get_env("KAFKA_ADMIN_USER", "") : "inter_broker_user"
+  vault_k8s_role  = get_env("VAULT_K8S_ROLE", "") != "" ? get_env("VAULT_K8S_ROLE", "") : "terraform"
+  vault_k8s_auth  = get_env("VAULT_K8S_AUTH_BACKEND", "") != "" ? get_env("VAULT_K8S_AUTH_BACKEND", "") : "kubernetes"
+}
+
 remote_state {
   backend = "s3"
   generate = {
@@ -78,17 +95,17 @@ provider "kubernetes" {
 provider "vault" {
 %{if get_env("VAULT_TOKEN", "") == ""~}
   auth_login_kubernetes {
-    role       = "${get_env("VAULT_K8S_ROLE", "terraform")}"
-    mount_path = "auth/${get_env("VAULT_K8S_AUTH_BACKEND", "kubernetes")}"
+    role       = "${local.vault_k8s_role}"
+    mount_path = "auth/${local.vault_k8s_auth}"
   }
 %{endif~}
 }
 
 # In-cluster PostgreSQL (admin). Password injected from Vault secrets/postgresql/admin.
 provider "postgresql" {
-  host      = "${get_env("PG_ADMIN_HOST", "postgresql.postgresql.svc.cluster.local")}"
-  port      = ${get_env("PG_ADMIN_PORT", "5432")}
-  username  = "${get_env("PG_ADMIN_USER", "postgres")}"
+  host      = "${local.pg_host}"
+  port      = ${local.pg_port}
+  username  = "${local.pg_user}"
   password  = "${get_env("PG_ADMIN_PASSWORD", "")}"
   sslmode   = "disable"
   superuser = false
@@ -96,16 +113,16 @@ provider "postgresql" {
 
 # In-cluster Kafka (Bitnami). Admin = inter_broker super-user from Vault secrets/kafka/bootstrap.
 provider "kafka" {
-  bootstrap_servers = ["${get_env("KAFKA_BOOTSTRAP", "kafka-kafka-contour-controller-0.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094")}"]
-  tls_enabled       = ${get_env("KAFKA_TLS_ENABLED", "false")}
+  bootstrap_servers = ["${local.kafka_bootstrap}"]
+  tls_enabled       = ${local.kafka_tls}
 %{if get_env("KAFKA_CA_CERT", "") != ""~}
   ca_cert = <<-EOT
 ${get_env("KAFKA_CA_CERT", "")}
 EOT
 %{endif~}
 %{if get_env("KAFKA_ADMIN_PASSWORD", "") != ""~}
-  sasl_mechanism    = "${get_env("KAFKA_SASL_MECHANISM", "plain")}"
-  sasl_username     = "${get_env("KAFKA_ADMIN_USER", "inter_broker_user")}"
+  sasl_mechanism    = "${local.kafka_mechanism}"
+  sasl_username     = "${local.kafka_user}"
   sasl_password     = "${get_env("KAFKA_ADMIN_PASSWORD", "")}"
 %{endif~}
 }