terraform-contour-mirror/live/terragrunt.hcl

remote_state {
  backend = "s3"
  generate = {
    path      = "backend.tf"
    if_exists = "overwrite_terragrunt"
  }
  config = {
    endpoint                    = "https://storage.yandexcloud.net"
    bucket                      = get_env("S3_PROD_STATE_BUCKET", "tfstate-terragrunt-prod")
    key                         = "${path_relative_to_include()}/terraform.tfstate"
    region                      = "ru-central1"
    access_key                  = get_env("S3_ACCESS_KEY", get_env("AWS_ACCESS_KEY_ID", ""))
    secret_key                  = get_env("S3_SECRET_KEY", get_env("AWS_SECRET_ACCESS_KEY", ""))
    skip_region_validation      = true
    skip_credentials_validation = true
    skip_metadata_api_check     = true
    force_path_style            = true
    skip_bucket_root_access     = true
    # Object Storage бакет без versioning/SSE; свежий terragrunt иначе падает на проверке.
    skip_bucket_versioning             = true
    skip_bucket_ssencryption           = true
    skip_bucket_enforced_tls           = true
    skip_bucket_public_access_blocking = true
  }
}

# Генерация общего провайдера для всех модулей
generate "provider" {
  path      = "provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
terraform {
  required_version = ">= 1.0"

  required_providers {
    yandex = {
      source  = "yandex-cloud/yandex"
      version = ">= 0.161.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.23"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.1"
    }
    rabbitmq = {
      source  = "cyrilgdn/rabbitmq"
      version = "~> 1.8"
    }
  }
}

provider "yandex" {
  token                    = var.yc_token != "" ? var.yc_token : null
  service_account_key_file = var.yc_service_account_key_file != "" ? var.yc_service_account_key_file : null
  cloud_id                 = var.yc_cloud_id != "" ? var.yc_cloud_id : null
  folder_id                = var.yc_folder_id != "" ? var.yc_folder_id : null
  zone                     = "ru-central1-a"
}

provider "kubernetes" {
  # Если kubeconfig_path указан и файл существует - используем его
  # Иначе провайдер автоматически использует in-cluster config (для runner'а в k8s)
  config_path    = var.kubeconfig_path != "" ? var.kubeconfig_path : null
  config_context = var.kube_context != "" ? var.kube_context : null
}

variable "yc_token" {
  type        = string
  default     = ""
  description = "Yandex Cloud IAM token"
}

variable "yc_service_account_key_file" {
  type        = string
  default     = ""
  description = "Path to Yandex Cloud service account key file"
}

variable "yc_cloud_id" {
  type        = string
  default     = ""
  description = "Yandex Cloud ID"
}

variable "yc_folder_id" {
  type        = string
  default     = ""
  description = "Yandex Cloud folder ID"
}

variable "kubeconfig_path" {
  type        = string
  default     = ""
  description = "Path to kubeconfig file"
}

variable "kube_context" {
  type        = string
  default     = ""
  description = "Kubernetes context"
}
EOF
}