Torjus Håkestad
b2b6ab4799
Configure Garage object storage on garage01 with S3 API, Vault secrets for RPC secret and admin token, and Caddy reverse proxy for HTTPS access at s3.home.2rjus.net via internal ACME CA. Includes flake entry, VM definition, and Vault policy for the host. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
83 lines
1.9 KiB
HCL
83 lines
1.9 KiB
HCL
# WARNING: Auto-generated by create-host tool
|
|
# Manual edits will be overwritten when create-host is run
|
|
|
|
# Generated host policies
|
|
# Each host gets access to its own secrets under hosts/<hostname>/*
|
|
locals {
|
|
generated_host_policies = {
|
|
"testvm01" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm01/*",
|
|
]
|
|
}
|
|
"testvm02" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm02/*",
|
|
]
|
|
}
|
|
"testvm03" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm03/*",
|
|
]
|
|
}
|
|
"ns2" = {
|
|
paths = [
|
|
"secret/data/hosts/ns2/*",
|
|
"secret/data/shared/dns/*",
|
|
]
|
|
}
|
|
"ns1" = {
|
|
paths = [
|
|
"secret/data/hosts/ns1/*",
|
|
"secret/data/shared/dns/*",
|
|
"secret/data/shared/homelab-deploy/*",
|
|
]
|
|
}
|
|
"nix-cache02" = {
|
|
paths = [
|
|
"secret/data/hosts/nix-cache02/*",
|
|
"secret/data/shared/homelab-deploy/*",
|
|
]
|
|
}
|
|
"garage01" = {
|
|
paths = [
|
|
"secret/data/hosts/garage01/*",
|
|
]
|
|
}
|
|
|
|
}
|
|
|
|
# Placeholder secrets - user should add actual secrets manually or via tofu
|
|
generated_secrets = {
|
|
}
|
|
}
|
|
|
|
# Create policies for generated hosts
|
|
resource "vault_policy" "generated_host_policies" {
|
|
for_each = local.generated_host_policies
|
|
|
|
name = "host-${each.key}"
|
|
|
|
policy = <<-EOT
|
|
# Allow host to read its own secrets
|
|
%{for path in each.value.paths~}
|
|
path "${path}" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
%{endfor~}
|
|
EOT
|
|
}
|
|
|
|
# Create AppRoles for generated hosts
|
|
resource "vault_approle_auth_backend_role" "generated_hosts" {
|
|
for_each = local.generated_host_policies
|
|
|
|
backend = vault_auth_backend.approle.path
|
|
role_name = each.key
|
|
token_policies = ["host-${each.key}", "homelab-deploy", "nixos-exporter"]
|
|
secret_id_ttl = 0 # Never expire (wrapped tokens provide time limit)
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
secret_id_num_uses = 0 # Unlimited uses
|
|
}
|