mirror of
https://git.sr.ht/~magic_rb/dotfiles
synced 2024-11-30 03:56:12 +01:00
46 lines
1.1 KiB
HCL
46 lines
1.1 KiB
HCL
resource "consul_acl_policy" "replication" {
|
|
count = var.replication_token_path != "" ? 1 : 0
|
|
|
|
name = "${var.hostname}-consul-replication"
|
|
datacenters = ["homelab-1"]
|
|
rules = <<EOF
|
|
acl = "write"
|
|
|
|
operator = "write"
|
|
|
|
service_prefix "" {
|
|
policy = "read"
|
|
intentions = "read"
|
|
}
|
|
EOF
|
|
}
|
|
|
|
resource "consul_acl_token" "consul-replication" {
|
|
count = var.replication_token_path != "" ? 1 : 0
|
|
|
|
description = "Consul replication token on ${var.hostname}"
|
|
policies = [
|
|
consul_acl_policy.replication[0].name,
|
|
]
|
|
local = false
|
|
}
|
|
|
|
data "consul_acl_token_secret_id" "consul-replication" {
|
|
count = var.replication_token_path != "" ? 1 : 0
|
|
|
|
accessor_id = consul_acl_token.consul-replication[0].id
|
|
}
|
|
|
|
|
|
resource "vault_kv_secret_v2" "consul-replication" {
|
|
count = var.replication_token_path != "" ? 1 : 0
|
|
|
|
mount = var.vault_mount.path
|
|
name = var.replication_token_path
|
|
delete_all_versions = true
|
|
data_json = jsonencode({
|
|
secret = data.consul_acl_token_secret_id.consul-replication[0].secret_id
|
|
accessor = consul_acl_token.consul-replication[0].id
|
|
})
|
|
}
|