Torjus Håkestad
e9857afc11
Instead of creating a long-lived Vault token in Terraform (which gets invalidated when Terraform recreates it), monitoring01 now uses its existing AppRole credentials to fetch a fresh token for Prometheus. Changes: - Add prometheus-metrics policy to monitoring01's AppRole - Remove vault_token.prometheus_metrics resource from Terraform - Remove openbao-token KV secret from Terraform - Add systemd service to fetch AppRole token on boot - Add systemd timer to refresh token every 30 minutes This ensures Prometheus always has a valid token without depending on Terraform state or manual intervention. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
129 lines
2.6 KiB
HCL
129 lines
2.6 KiB
HCL
# Enable AppRole auth backend
|
|
resource "vault_auth_backend" "approle" {
|
|
type = "approle"
|
|
path = "approle"
|
|
}
|
|
|
|
# Define host access policies
|
|
locals {
|
|
host_policies = {
|
|
# Example: monitoring01 host
|
|
# "monitoring01" = {
|
|
# paths = [
|
|
# "secret/data/hosts/monitoring01/*",
|
|
# "secret/data/services/prometheus/*",
|
|
# "secret/data/services/grafana/*",
|
|
# "secret/data/shared/smtp/*"
|
|
# ]
|
|
# extra_policies = ["some-other-policy"] # Optional: additional policies
|
|
# }
|
|
|
|
# Example: ha1 host
|
|
# "ha1" = {
|
|
# paths = [
|
|
# "secret/data/hosts/ha1/*",
|
|
# "secret/data/shared/mqtt/*"
|
|
# ]
|
|
# }
|
|
|
|
"ha1" = {
|
|
paths = [
|
|
"secret/data/hosts/ha1/*",
|
|
"secret/data/shared/backup/*",
|
|
]
|
|
}
|
|
|
|
"monitoring01" = {
|
|
paths = [
|
|
"secret/data/hosts/monitoring01/*",
|
|
"secret/data/shared/backup/*",
|
|
"secret/data/shared/nats/*",
|
|
]
|
|
extra_policies = ["prometheus-metrics"]
|
|
}
|
|
|
|
# Wave 1: hosts with no service secrets (only need vault.enable for future use)
|
|
"nats1" = {
|
|
paths = [
|
|
"secret/data/hosts/nats1/*",
|
|
]
|
|
}
|
|
|
|
"jelly01" = {
|
|
paths = [
|
|
"secret/data/hosts/jelly01/*",
|
|
]
|
|
}
|
|
|
|
"pgdb1" = {
|
|
paths = [
|
|
"secret/data/hosts/pgdb1/*",
|
|
]
|
|
}
|
|
|
|
# Wave 3: DNS servers
|
|
"ns1" = {
|
|
paths = [
|
|
"secret/data/hosts/ns1/*",
|
|
"secret/data/shared/dns/*",
|
|
]
|
|
}
|
|
|
|
"ns2" = {
|
|
paths = [
|
|
"secret/data/hosts/ns2/*",
|
|
"secret/data/shared/dns/*",
|
|
]
|
|
}
|
|
|
|
# Wave 4: http-proxy
|
|
"http-proxy" = {
|
|
paths = [
|
|
"secret/data/hosts/http-proxy/*",
|
|
]
|
|
}
|
|
|
|
# Wave 5: nix-cache01
|
|
"nix-cache01" = {
|
|
paths = [
|
|
"secret/data/hosts/nix-cache01/*",
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
# Generate policies for each host
|
|
resource "vault_policy" "host_policies" {
|
|
for_each = local.host_policies
|
|
|
|
name = "${each.key}-policy"
|
|
|
|
policy = <<EOT
|
|
%{~for path in each.value.paths~}
|
|
path "${path}" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
%{~endfor~}
|
|
EOT
|
|
}
|
|
|
|
# Generate AppRoles for each host
|
|
resource "vault_approle_auth_backend_role" "hosts" {
|
|
for_each = local.host_policies
|
|
|
|
backend = vault_auth_backend.approle.path
|
|
role_name = each.key
|
|
token_policies = concat(
|
|
["${each.key}-policy"],
|
|
lookup(each.value, "extra_policies", [])
|
|
)
|
|
|
|
# Token configuration
|
|
token_ttl = 3600 # 1 hour
|
|
token_max_ttl = 86400 # 24 hours
|
|
|
|
# Security settings
|
|
bind_secret_id = true
|
|
secret_id_ttl = 0 # Never expire (we'll rotate manually)
|
|
}
|