terraform-contour-mirror/infrastructure.yaml

environments:
  prod:
    kafka_cluster_refs:
      prod:
        cluster_id: c9qks74g084g1419cpts
        default_partitions: 3
        default_replication_factor: 1
        max_replication_factor: 1
        default_topic_config:
          cleanup.policy: delete
          retention.ms: "604800000"
          min.insync.replicas: "2"

    kafka_policy:
      allow_create: true
      allow_delete: false
      allow_partition_increase: true
      allow_partition_decrease: false

    kafka:
      topics:
        - name: sarex.prod.kafka-topics-test.events.v1
          owner: kafka-topics-test
          clusterRef: prod
          partitions: 1
          replicationFactor: 1
          config:
            cleanup.policy: delete
            retention.ms: "604800000"
            min.insync.replicas: "1"
          deletionPolicy: orphan
        - name: eav.attribute.created.v1
          owner: platform
          clusterRef: prod
          partitions: 3
          replicationFactor: 1
          config:
            cleanup.policy: delete
            retention.ms: "604800000"
            min.insync.replicas: "1"
          deletionPolicy: orphan
          ownerRoles: []
        - name: eav.attribute.updated.v1
          owner: platform
          clusterRef: prod
          partitions: 3
          replicationFactor: 1
          config:
            cleanup.policy: delete
            retention.ms: "604800000"
            min.insync.replicas: "1"
          deletionPolicy: orphan
          ownerRoles: []
        - name: eav.attribute.deleted.v1
          owner: platform
          clusterRef: prod
          partitions: 3
          replicationFactor: 1
          config:
            cleanup.policy: delete
            retention.ms: "604800000"
            min.insync.replicas: "1"
          deletionPolicy: orphan
          ownerRoles: []
        - name: eav.value_option.created.v1
          owner: platform
          clusterRef: prod
          partitions: 3
          replicationFactor: 1
          config:
            cleanup.policy: delete
            retention.ms: "604800000"
            min.insync.replicas: "1"
          deletionPolicy: orphan
          ownerRoles: []
        - name: eav.value_option.deleted.v1
          owner: platform
          clusterRef: prod
          partitions: 3
          replicationFactor: 1
          config:
            cleanup.policy: delete
            retention.ms: "604800000"
            min.insync.replicas: "1"
          deletionPolicy: orphan
          ownerRoles: []
      users:
        - name: premises
          clusterRef: prod
          adoptExisting: true
          permissions:
            - topic: premises
              roles: ["ACCESS_ROLE_CONSUMER", "ACCESS_ROLE_PRODUCER"]
            - topic: eav.attribute.created.v1
              roles: ["ACCESS_ROLE_CONSUMER"]
            - topic: eav.attribute.deleted.v1
              roles: ["ACCESS_ROLE_CONSUMER"]
            - topic: eav.attribute.updated.v1
              roles: ["ACCESS_ROLE_CONSUMER"]
            - topic: eav.value_option.created.v1
              roles: ["ACCESS_ROLE_CONSUMER"]
            - topic: eav.value_option.deleted.v1
              roles: ["ACCESS_ROLE_CONSUMER"]

    rabbitmq:
      management_endpoint: http://default-rabbit-cluster.rabbitmq.svc.cluster.local:15672
      amqp_host: default-rabbit-cluster.rabbitmq.svc.cluster.local
      amqp_port: 5672
      policy:
        allow_create: true
        allow_delete: false
      vhosts:
        - name: iac-smoke-prod
      users:
        - name: iac-smoke-prod
      permissions:
        - vhost: iac-smoke-prod
          user: iac-smoke-prod
          configure: "^iac\\.smoke\\..*"
          write: "^iac\\.smoke\\..*"
          read: "^iac\\.smoke\\..*"
      exchanges:
        - vhost: iac-smoke-prod
          name: iac.smoke.events
          type: topic
          durable: true
          auto_delete: false
      queues:
        - vhost: iac-smoke-prod
          name: iac.smoke.queue
          durable: true
          auto_delete: false
          arguments:
            x-queue-type: quorum
      bindings:
        - vhost: iac-smoke-prod
          source: iac.smoke.events
          destination: iac.smoke.queue
          destination_type: queue
          routing_key: iac.smoke.created
      policies:
        - vhost: iac-smoke-prod
          name: iac-smoke-queue-ttl
          pattern: "^iac\\.smoke\\..*"
          apply_to: queues
          priority: 1
          definition:
            message-ttl: 600000

    namespaces:
      - name: block-analyzer
        labels:
          project: block-analyzer
        annotations:
          managed-by: terraform 
      - name: pulse
        labels:
          environment: stage
          project: pulse
          istio-injection: enabled
        annotations:
          managed-by: terraform
      - name: proc
        labels:
          team: proc
          istio-injection: enabled
        annotations:
          managed-by: terraform 
      - name: iam
        labels:
          team: platform
          istio-injection: enabled
        annotations:
          managed-by: terraform     
      - name: ai
        labels:
          istio-injection: enabled
        annotations:
          managed-by: terraform

    secrets:
      - name: analyzer-postgresql-secret
        namespace: block-analyzer
        type: database
        dependencies:
          cluster: "c9quu72dj2ibu8dk54q5"
          db: analyzer_db
          user: analyzer
        custom_keys:
          sslmode: "verify-full"
        random_keys:
          full-host:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      - name: dockerhub
        namespace: pulse
        type: dockerconfigjson
        registry_url: cr.yandex

      - name: sarex-agents-valkey-secret
        namespace: ai
        type: valkey
        dependencies:
          valkey_cluster: "c9qb9l18fvb0vg2nrcq4"
          valkey_user: sarex-agents
        lifecycle:
          ignore_changes: true

      - name: ai-agents-s3-secret
        namespace: ai
        type: s3
        dependencies:
          bucket: ai-agents-prod
        lifecycle:
          ignore_changes: false

      - name: postgresql-secret
        namespace: ai
        type: database_url
        dependencies:
          cluster: "c9quu72dj2ibu8dk54q5"
          db: document-understanding
          user: document-understanding
        lifecycle:
          ignore_changes: true

      - name: gemini-api-key
        namespace: ai
        type: opaque
        random_keys:
          gemini_api_key:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      - name: mvp-agents-secrets
        namespace: ai
        type: opaque
        random_keys:
          GEMINI_API_KEY:
            length: 32
            special: false
          LANGSMITH_API_KEY:
            length: 32
            special: false
          POSTGRES_URI:
            length: 32
            special: false
          REDIS_URI:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      - name: openai-api-key
        namespace: ai
        type: opaque
        random_keys:
          openai_api_key:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      - name: sarex-agents-secrets
        namespace: ai
        type: opaque
        random_keys:
          GEMINI_API_KEY:
            length: 32
            special: false
          LANGSMITH_API_KEY:
            length: 32
            special: false
          OPENAI_API_KEY:
            length: 32
            special: false
          POSTGRES_URI:
            length: 32
            special: false
          REDIS_URI:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      - name: pulse-s3-secret
        namespace: pulse
        type: s3
        dependencies:
          bucket: pulse-prod
        lifecycle:
          ignore_changes: false


      - name: pulse-postgresql-secret
        namespace: pulse
        type: database
        dependencies:
          cluster: "c9quu72dj2ibu8dk54q5"
          db: pulse_db
          user: pulse
        lifecycle:
          ignore_changes: true

      - name: rabbitmq-iac-smoke-secret
        namespace: pulse
        type: rabbitmq
        dependencies:
          rabbitmq_vhost: iac-smoke-prod
          rabbitmq_user: iac-smoke-prod
        lifecycle:
          ignore_changes: true

      - name: iams-secret
        namespace: iam
        type: opaque
        random_keys:
          db-dsn:
            length: 5
            special: false
          kafka-sasl-plain-username:
            length: 5
            special: false
          kafka-sasl-plain-password:
            length: 5
            special: false
        lifecycle:
          ignore_changes: true  

      - name: yc-s3-secret
        namespace: iam
        type: opaque
        random_keys:
          access_key:
            length: 5
            special: false
          key_id:
            length: 5
            special: false
        lifecycle:
          ignore_changes: true         
    

      - name: premises-s3-secret
        namespace: proc
        type: s3
        dependencies:
          bucket: premises-prod
        lifecycle:
          ignore_changes: true    

      - name: premises-postgresql-secret
        namespace: proc
        type: database
        dependencies:
          cluster: "c9quu72dj2ibu8dk54q5"
          db: premises_db
          user: premises
        lifecycle:
          ignore_changes: true  

      - name: premises-kafka-secret
        namespace: proc
        type: opaque
        custom_keys:
          host: "host:port"
        random_keys:
          password:
            length: 5
            special: false
          username:
            length: 5
            special: false
          cert:
            length: 5
            special: false
        lifecycle:
          ignore_changes: true      

      - name: session-secret
        namespace: pulse
        type: opaque
        random_keys:
          key:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      - name: valkey-secret
        namespace: documentations-prod
        type: opaque
        custom_keys:
          url: "host:port"
        random_keys:
          host:
            length: 5
            special: false
          port:
            length: 5
            special: false
          cert:
            length: 5
            special: false
          login:
            length: 5
            special: false   
          password:
            length: 5
            special: false   
        lifecycle:
          ignore_changes: true   

      - name: cde-api-valkey-secret
        namespace: documentations-prod
        type: opaque
        custom_keys:
          url: "host:port"
        random_keys:
          host:
            length: 5
            special: false
          port:
            length: 5
            special: false
          cert:
            length: 5
            special: false
          login:
            length: 5
            special: false   
          password:
            length: 5
            special: false   
        lifecycle:
          ignore_changes: true 

      - name: cde-api-zeebe-secret
        namespace: documentations-prod
        type: opaque
        random_keys:
          gateway_address:
            length: 5
            special: false
          client_id:
            length: 5
            special: false
          client_secret:
            length: 5
            special: false
          auth_server_url:
            length: 5
            special: false   
        lifecycle:
          ignore_changes: true     

      - name: cde-api-s3-secret
        namespace: documentations-prod
        type: yc_sa
        dependencies:
          service_account: documentations-prod
        yc_sa_key_names:
          access_key: access_key
          secret_key: secret_key
          service_account_id: sa_id
        lifecycle:
          ignore_changes: true 

      - name: cde-api-postgresql-secret
        namespace: documentations-prod
        type: database
        dependencies:
          cluster: "c9qt5t4ccr0k4652f963"
          db: documentations
          user: prod-doc_user
        custom_keys:
          sslmode: "verify-full"
        random_keys:
          full-host:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true  

      - name: hasher-rabbitmq-secret
        namespace: documentations-prod
        type: opaque
        custom_keys:
          host: "default-rabbit-cluster.rabbitmq.svc.cluster.local"
          hostname: "default-rabbit-cluster.rabbitmq.svc.cluster.local:5672"
          port: "5672"
          user: "camunda"
          vhost: "camunda_prod"
        random_keys:
          password:
            length: 32
            special: false   
        lifecycle:
          ignore_changes: true  
          
      - name: hasher-s3-secret
        namespace: documentations-prod
        type: yc_sa
        dependencies:
          service_account: documentations-prod
        yc_sa_key_names:
          access_key: access_key
          secret_key: secret_key
          service_account_id: sa_id
        lifecycle:
          ignore_changes: true                     

      - name: bim-yc-clickhouse-secret
        namespace: bim-api-prod
        type: opaque
        custom_keys:
          CLICKHOUSE_SSL: "true"
        constant_keys:
          CLICKHOUSE_CERT: postgres_ca
        random_keys:
          CLICKHOUSE_HOST:
            length: 32
            special: false
          CLICKHOUSE_PORT:
            length: 5
            special: false
          CLICKHOUSE_HOSTNAME:
            length: 32
            special: false
          CLICKHOUSE_DATABASE:
            length: 32
            special: false
          CLICKHOUSE_USER:
            length: 32
            special: false
          CLICKHOUSE_PASSWORD:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      # # Пример секрета для другой базы данных (test_db/test)
      # - name: test-db-secret
      #   namespace: pulse
      #   type: database
      #   dependencies:
      #     cluster: "c9qa2coo5ukgcg93fldm"
      #     db: test_db
      #     user: test
      #   random_keys:
      #     session_key:
      #       length: 32
      #       special: false
      #   lifecycle:
      #     ignore_changes: false

      # # Пример секрета из SA ключей
      # - name: dwg-sa-secret
      #   namespace: pulse
      #   type: yc_sa
      #   dependencies:
      #     service_account: dwg-sa
      #   yc_sa_key_names: # как назвать ключи в секрете
      #     access_key: access_key
      #     secret_key: secret_key
      #     service_account_id: sa_id
      #   lifecycle:
      #     ignore_changes: false

    buckets:
      - name: pulse-prod
        acl: private
        versioning:
          enabled: false
        cors:
          enabled: false

      - name: premises-prod
        acl: private
        versioning:
          enabled: false
        cors:
          enabled: false    

      - name: ai-agents-prod
        acl: private
        role: storage.admin
        versioning:
          enabled: false
        cors:
          enabled: false

    # yc_service_accounts:
    #   - name: dwg-sa
    #     description: "DWG SA Uploader"
    #     folder_roles:
    #       - storage.uploader
    #     create_static_access_key: true


    databases:
      - cluster_id: "c9quu72dj2ibu8dk54q5"
        database:
          name: pulse_db
          extensions:
            - pg_stat_statements
        user:
          name: pulse
          password_length: 32
          password_special: false
          conn_limit: 10
          
      - cluster_id: "c9quu72dj2ibu8dk54q5"
        database:
          name: premises_db
          extensions:
            - uuid-ossp
        user:
          name: premises
          password_length: 32
          password_special: false
          conn_limit: 10

      - cluster_id: "c9quu72dj2ibu8dk54q5"
        database:
          name: document-understanding
          host: rc1b-384bzx2drqoaxt4d.mdb.yandexcloud.net
        user:
          name: document-understanding
          password_length: 32
          password_special: false
          conn_limit: 10

      - cluster_id: "c9q4rg96frgpk4g2q9p8"
        database:
          name: sarex-agents
          extensions:
            - ltree
            - pg_stat_statements
            - uuid-ossp
            - btree_gin
            - btree_gist
            - pgvector
        user:
          name: sarex-agents
          password_length: 32
          password_special: false
          conn_limit: 100

      - cluster_id: "c9quu72dj2ibu8dk54q5"
        database:
          name: analyzer_db
          extensions:
            - pg_stat_statements
        user:
          name: analyzer
          password_length: 32
          password_special: false
          conn_limit: 10
          permissions:
            - annotations
            - attachments
            - automation
            - bi
            - bim_allocator_db
            - camunda_db
            - camunda_new
            - checklists
            - comparator
            - comparisons
            - contracts_prod_db
            - data-engine_db
            - document-understanding
            - drawings
            - flow_db
            - inspections
            - issues
            - mailer
            - notes_db
            - pm_db
            - premises_db
            - preprod_sarex_db
            - processing
            - pulse_db
            - remarks
            - resources
            - restored_flow_db
            - rfi
            - sarex_compute
            - sarex_db
            - srx-data-engine
            - subscriptions
            - superset
            - system_log
            - transmittal
            - workspaces
    

    valkey_users:
      - cluster_id: "c9qb9l18fvb0vg2nrcq4"
        host: rc1d-qk3kd08nre0ntdu9.mdb.yandexcloud.net
        port: "6380"
        user:
          name: sarex-agents
          password_length: 32
          password_special: false
          enabled: true
        permissions:
          patterns: allkeys
          pubSubChannels: allchannels
          categories: "+@read +@write"
          commands: "+GET -FLUSHALL"
          sanitizePayload: sanitize-payload