Torjus Håkestad
ca0e3fd629
Some checks failed
Run nix flake check / flake-check (push) Failing after 1s
- New test-tier VM at 10.69.13.23 with role=auth - Kanidm 1.8 server with HTTPS (443) and LDAPS (636) - ACME certificate from internal CA (auth.home.2rjus.net) - Provisioned groups: admins, users, ssh-users - Provisioned user: torjus - Daily backups at 22:00 (7 versions) - Prometheus monitoring scrape target Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
78 lines
1.8 KiB
HCL
78 lines
1.8 KiB
HCL
# WARNING: Auto-generated by create-host tool
|
|
# Manual edits will be overwritten when create-host is run
|
|
|
|
# Generated host policies
|
|
# Each host gets access to its own secrets under hosts/<hostname>/*
|
|
locals {
|
|
generated_host_policies = {
|
|
"testvm01" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm01/*",
|
|
]
|
|
}
|
|
"testvm02" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm02/*",
|
|
]
|
|
}
|
|
"testvm03" = {
|
|
paths = [
|
|
"secret/data/hosts/testvm03/*",
|
|
]
|
|
}
|
|
"ns2" = {
|
|
paths = [
|
|
"secret/data/hosts/ns2/*",
|
|
"secret/data/shared/dns/*",
|
|
]
|
|
}
|
|
"ns1" = {
|
|
paths = [
|
|
"secret/data/hosts/ns1/*",
|
|
"secret/data/shared/dns/*",
|
|
"secret/data/shared/homelab-deploy/*",
|
|
]
|
|
}
|
|
"kanidm01" = {
|
|
paths = [
|
|
"secret/data/hosts/kanidm01/*",
|
|
"secret/data/kanidm/*",
|
|
]
|
|
}
|
|
|
|
}
|
|
|
|
# Placeholder secrets - user should add actual secrets manually or via tofu
|
|
generated_secrets = {
|
|
}
|
|
}
|
|
|
|
# Create policies for generated hosts
|
|
resource "vault_policy" "generated_host_policies" {
|
|
for_each = local.generated_host_policies
|
|
|
|
name = "host-${each.key}"
|
|
|
|
policy = <<-EOT
|
|
# Allow host to read its own secrets
|
|
%{for path in each.value.paths~}
|
|
path "${path}" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
%{endfor~}
|
|
EOT
|
|
}
|
|
|
|
# Create AppRoles for generated hosts
|
|
resource "vault_approle_auth_backend_role" "generated_hosts" {
|
|
for_each = local.generated_host_policies
|
|
|
|
backend = vault_auth_backend.approle.path
|
|
role_name = each.key
|
|
token_policies = ["host-${each.key}", "homelab-deploy"]
|
|
secret_id_ttl = 0 # Never expire (wrapped tokens provide time limit)
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
secret_id_num_uses = 0 # Unlimited uses
|
|
}
|