terraform-contour-mirror/live/secrets/terragrunt.hcl

include "root" {
  path = find_in_parent_folders()
}

locals {
  repo_root    = try(get_repo_root(), "${get_terragrunt_dir()}/../..")
  infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))

  env_override   = trimspace(get_env("INFRA_ENV", ""))
  env_from_file  = try(trimspace(local.infra_config.current_environment), "")
  available_envs = sort(keys(try(local.infra_config.environments, {})))
  env_fallback   = try(local.available_envs[0], "")

  env_name = local.env_override != "" ? local.env_override : (
    local.env_from_file != "" ? local.env_from_file : local.env_fallback
  )

  # Single declarative source: shape + data in one sops file. In CI it is
  # decrypted ahead of time and the path is passed via INFRA_SECRET_VALUES_FILE;
  # locally we fall back to direct sops decryption. Values reach the module only
  # via inputs (ephemeral), never written to disk.
  secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
  secret_values_raw      = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file("${local.repo_root}/infrastructure-secrets.yaml"), "")
  secret_values_config   = try(yamldecode(local.secret_values_raw), {})
  secret_values_env      = try(local.secret_values_config.environments[local.env_name], {})

  secrets = try(local.secret_values_env.secrets, [])

  secrets_input = [
    for secret in local.secrets : {
      name            = secret.name
      namespace       = try(secret.namespace, "")
      type            = try(secret.type, "opaque")
      registry_url    = try(secret.registry_url, "")
      data            = try(secret.data, {})
      depends_on      = try(secret.depends_on, {})
      yc_sa_key_names = try(secret.yc_sa_key_names, {})
      custom_keys     = try(secret.custom_keys, {})
      constant_keys   = try(secret.constant_keys, {})
      random_keys     = try(secret.random_keys, {})
      credential_keys = try(secret.credential_keys, {})
      labels          = try(secret.labels, {})
      annotations     = try(secret.annotations, {})
      ignore_changes  = try(secret.lifecycle.ignore_changes, false)
      # Sink: k8s (default) or vault. vault_path is the KV name (default <prefix>/<name>).
      sink       = try(secret.sink, "k8s")
      vault_path = try(secret.vault_path, "")
    }
  ]
}

dependency "namespace" {
  config_path                             = "../namespace"
  mock_outputs                            = { namespaces = {}, names = [] }
  mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
}

dependency "s3" {
  config_path                             = "../s3"
  mock_outputs                            = { bucket_name = "mock", access_key = "mock", secret_key = "mock", buckets = {}, service_accounts = {} }
  mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
}

dependency "database" {
  config_path                             = "../database"
  mock_outputs                            = { database_outputs_map = {} }
  mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
}

dependency "rabbitmq" {
  config_path                             = "../rabbitmq"
  mock_outputs                            = { rabbitmq_outputs_map = {} }
  mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
}

dependency "kafka_topics" {
  config_path                             = "../kafka-topics"
  mock_outputs                            = { kafka_outputs_map = {} }
  mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
}

remote_state {
  backend = "s3"
  generate = {
    path      = "backend.tf"
    if_exists = "overwrite_terragrunt"
  }
  config = {
    endpoint                    = get_env("TF_STATE_S3_ENDPOINT", "")
    bucket                      = get_env("TF_STATE_S3_BUCKET", "")
    key                         = "${local.env_name}/secrets/terraform.tfstate"
    region                      = get_env("TF_STATE_S3_REGION", "ru-central1")
    access_key                  = get_env("S3_ACCESS_KEY", get_env("AWS_ACCESS_KEY_ID", ""))
    secret_key                  = get_env("S3_SECRET_KEY", get_env("AWS_SECRET_ACCESS_KEY", ""))
    skip_region_validation      = true
    skip_credentials_validation = true
    skip_metadata_api_check     = true
    skip_bucket_root_access     = true
    force_path_style            = true
  }
}

terraform {
  source = "${get_terragrunt_dir()}/../../modules//k8s-secret"
}

inputs = {
  secrets = local.secrets_input

  s3_outputs = {
    bucket_name = dependency.s3.outputs.bucket_name
    access_key  = dependency.s3.outputs.access_key
    secret_key  = dependency.s3.outputs.secret_key
  }
  s3_buckets_map          = try(dependency.s3.outputs.buckets, {})
  yc_service_accounts_map = try(dependency.s3.outputs.service_accounts, {})

  database_outputs_map = dependency.database.outputs.database_outputs_map
  rabbitmq_outputs_map = try(dependency.rabbitmq.outputs.rabbitmq_outputs_map, {})
  kafka_outputs_map    = try(dependency.kafka_topics.outputs.kafka_outputs_map, {})
  valkey_outputs_map   = {}

  # In-cluster constants (contour). No managed-YC CA; in-cluster pgbouncer/pg on 5432.
  constants = {
    s3_endpoint   = try(local.infra_config.environments[local.env_name].minio.endpoint, "http://minio.minio.svc.cluster.local:9000")
    postgres_port = "5432"
    postgres_ca   = ""
    valkey_port   = "6379"
    valkey_ca     = ""
  }

  # Vault sink target (KV v2). Mount/prefix match the vault-secrets platform layout.
  vault_kv_mount    = try(local.secret_values_env.vault.kv_mount, "secrets")
  vault_path_prefix = try(local.secret_values_env.vault.path_prefix, "vault")

  env_vars = {
    DOCKER_REGISTRY_USERNAME = get_env("DOCKER_REGISTRY_USERNAME", "")
    DOCKER_REGISTRY_PASSWORD = get_env("DOCKER_REGISTRY_PASSWORD", "")
  }

  kubeconfig_path = get_env("KUBECONFIG", "")
  kube_context    = get_env("KUBE_CONTEXT", "")
}