Torjus Håkestad
6184f4cbbb
Some checks failed
Run nix flake check / flake-check (push) Has been cancelled
- Switch vmalert from blackhole mode to sending alerts to local Alertmanager - Import alerttonotify service so alerts route to NATS notifications - Move alertmanager and grafana CNAMEs from http-proxy to monitoring02 - Add monitoring CNAME to monitoring02 - Add Caddy reverse proxy entries for alertmanager and grafana - Remove prometheus, alertmanager, and grafana Caddy entries from http-proxy (now served directly by monitoring02) - Move monitoring02 Vault AppRole to hosts-generated.tf with extra_policies support and prometheus-metrics policy - Update Promtail to use authenticated loki.home.2rjus.net endpoint only (remove unauthenticated monitoring01 client) - Update pipe-to-loki and bootstrap to use loki.home.2rjus.net with basic auth from Vault secret - Update migration plan with current status Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
95 lines
2.3 KiB
HCL
95 lines
2.3 KiB
HCL
# WARNING: Auto-generated by create-host tool
|
|
# Manual edits will be overwritten when create-host is run
|
|
|
|
# Generated host policies
|
|
# Each host gets access to its own secrets under hosts/<hostname>/*
|
|
locals {
|
|
generated_host_policies = {
|
|
"testvm01" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm01/*",
|
|
]
|
|
}
|
|
"testvm02" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm02/*",
|
|
]
|
|
}
|
|
"testvm03" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm03/*",
|
|
]
|
|
}
|
|
"ns2" = {
|
|
paths = [
|
|
"secret/data/hosts/ns2/*",
|
|
"secret/data/shared/dns/*",
|
|
]
|
|
}
|
|
"ns1" = {
|
|
paths = [
|
|
"secret/data/hosts/ns1/*",
|
|
"secret/data/shared/dns/*",
|
|
"secret/data/shared/homelab-deploy/*",
|
|
]
|
|
}
|
|
"nix-cache02" = {
|
|
paths = [
|
|
"secret/data/hosts/nix-cache02/*",
|
|
"secret/data/shared/homelab-deploy/*",
|
|
]
|
|
}
|
|
"garage01" = {
|
|
paths = [
|
|
"secret/data/hosts/garage01/*",
|
|
]
|
|
}
|
|
"monitoring02" = {
|
|
paths = [
|
|
"secret/data/hosts/monitoring02/*",
|
|
"secret/data/hosts/monitoring01/apiary-token",
|
|
"secret/data/services/grafana/*",
|
|
"secret/data/shared/nats/nkey",
|
|
]
|
|
extra_policies = ["prometheus-metrics"]
|
|
}
|
|
|
|
}
|
|
|
|
# Placeholder secrets - user should add actual secrets manually or via tofu
|
|
generated_secrets = {
|
|
}
|
|
}
|
|
|
|
# Create policies for generated hosts
|
|
resource "vault_policy" "generated_host_policies" {
|
|
for_each = local.generated_host_policies
|
|
|
|
name = "host-${each.key}"
|
|
|
|
policy = <<-EOT
|
|
# Allow host to read its own secrets
|
|
%{for path in each.value.paths~}
|
|
path "${path}" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
%{endfor~}
|
|
EOT
|
|
}
|
|
|
|
# Create AppRoles for generated hosts
|
|
resource "vault_approle_auth_backend_role" "generated_hosts" {
|
|
for_each = local.generated_host_policies
|
|
|
|
backend = vault_auth_backend.approle.path
|
|
role_name = each.key
|
|
token_policies = concat(
|
|
["host-${each.key}", "homelab-deploy", "nixos-exporter", "loki-push"],
|
|
lookup(each.value, "extra_policies", [])
|
|
)
|
|
secret_id_ttl = 0 # Never expire (wrapped tokens provide time limit)
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
secret_id_num_uses = 0 # Unlimited uses
|
|
}
|