mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
78 lines
4.1 KiB
HCL
78 lines
4.1 KiB
HCL
include "root" {
|
||
path = find_in_parent_folders()
|
||
}
|
||
|
||
locals {
|
||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../..")
|
||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
||
secrets_file = "${local.repo_root}/infrastructure-secrets.yaml"
|
||
|
||
# В CI файл расшифровывается заранее одним шагом, и путь передаётся через
|
||
# INFRA_SECRET_VALUES_FILE (SOPS_AGE_KEY нужен только этому шагу, не всей
|
||
# джобе). Локально - fallback на прямую расшифровку через sops_decrypt_file.
|
||
secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
|
||
secrets_config_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file(local.secrets_file), "")
|
||
secrets_config = try(yamldecode(local.secrets_config_raw), {})
|
||
|
||
env_override = trimspace(get_env("INFRA_ENV", ""))
|
||
env_from_file = try(trimspace(local.infra_config.current_environment), "")
|
||
available_envs = sort(keys(try(local.secrets_config.environments, {})))
|
||
env_fallback = try(local.available_envs[0], "")
|
||
|
||
env_name = local.env_override != "" ? local.env_override : (
|
||
local.env_from_file != "" ? local.env_from_file : local.env_fallback
|
||
)
|
||
|
||
env_config = try(local.secrets_config.environments[local.env_name], {})
|
||
vault_config = try(local.env_config.vault, {})
|
||
vault_enabled = try(local.vault_config.enabled, false)
|
||
}
|
||
|
||
remote_state {
|
||
backend = "s3"
|
||
generate = {
|
||
path = "backend.tf"
|
||
if_exists = "overwrite_terragrunt"
|
||
}
|
||
config = {
|
||
endpoint = get_env("TF_STATE_S3_ENDPOINT", "")
|
||
bucket = get_env("TF_STATE_S3_BUCKET", "")
|
||
key = "${local.env_name}/vault-secrets/terraform.tfstate"
|
||
region = get_env("TF_STATE_S3_REGION", "ru-central1")
|
||
access_key = get_env("S3_ACCESS_KEY", get_env("AWS_ACCESS_KEY_ID", ""))
|
||
secret_key = get_env("S3_SECRET_KEY", get_env("AWS_SECRET_ACCESS_KEY", ""))
|
||
skip_region_validation = true
|
||
skip_credentials_validation = true
|
||
skip_metadata_api_check = true
|
||
skip_bucket_root_access = true
|
||
force_path_style = true
|
||
}
|
||
}
|
||
|
||
terraform {
|
||
source = "${get_terragrunt_dir()}/../../modules//vault-platform-secrets"
|
||
}
|
||
|
||
inputs = {
|
||
vault_kv_mount = try(local.vault_config.kv_mount, "secrets")
|
||
path_prefix = try(local.vault_config.path_prefix, "vault")
|
||
# Секретные значения обёрнуты под vault.data.* (см. .sops.yaml) - шифруется
|
||
# только этот поддерево, а не весь файл. applications ниже - конфиг policy/
|
||
# role, секретов не содержит, поэтому вне data.
|
||
common = try(local.vault_config.data.common, {})
|
||
infra = try(local.vault_config.data.infrastructure, {})
|
||
applications = try(local.vault_config.applications, {})
|
||
default_rsa_bits = try(local.vault_config.default_rsa_bits, 4096)
|
||
kubernetes_auth_backend = try(local.vault_config.kubernetes_auth_backend, "kubernetes")
|
||
|
||
create_regcred = local.vault_enabled && try(local.vault_config.features.create_regcred, true)
|
||
create_smtp_auth = local.vault_enabled && try(local.vault_config.features.create_smtp_auth, true)
|
||
create_django_auth = local.vault_enabled && try(local.vault_config.features.create_django_auth, true)
|
||
create_rsa_keys = local.vault_enabled && try(local.vault_config.features.create_rsa_keys, true)
|
||
create_infra_secrets = local.vault_enabled && try(local.vault_config.features.create_infra_secrets, true)
|
||
create_infra_policies = local.vault_enabled && try(local.vault_config.features.create_infra_policies, true)
|
||
create_infra_roles = local.vault_enabled && try(local.vault_config.features.create_infra_roles, true)
|
||
create_app_policies = local.vault_enabled && try(local.vault_config.features.create_app_policies, true)
|
||
create_app_roles = local.vault_enabled && try(local.vault_config.features.create_app_roles, true)
|
||
}
|