2022-11-29 18:02:29 +00:00
|
|
|
locals {
|
|
|
|
|
allowed_policies= concat(local.nomad_policy, [
|
|
|
|
|
])
|
|
|
|
|
|
|
|
|
|
nomad_policy=[
|
|
|
|
|
"crowdsec",
|
|
|
|
|
"dump",
|
|
|
|
|
"dentrite",
|
2023-08-25 08:15:06 +00:00
|
|
|
"droneci",
|
2023-09-17 16:28:12 +00:00
|
|
|
"traefik",
|
2022-11-29 18:02:29 +00:00
|
|
|
"gitea",
|
|
|
|
|
"nextcloud",
|
|
|
|
|
"paperless",
|
|
|
|
|
"pihole",
|
|
|
|
|
"prometheus",
|
|
|
|
|
"rsyncd",
|
|
|
|
|
"seedbox",
|
|
|
|
|
"supysonic",
|
|
|
|
|
"ttrss",
|
|
|
|
|
"vaultwarden",
|
|
|
|
|
"wikijs",
|
|
|
|
|
"vikunja",
|
2023-09-04 16:52:49 +00:00
|
|
|
"ghostfolio",
|
2023-10-07 15:34:17 +00:00
|
|
|
"alertmanager",
|
2023-11-01 17:58:42 +00:00
|
|
|
"vault-backup"
|
2022-11-29 18:02:29 +00:00
|
|
|
]
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
resource "vault_token_auth_backend_role" "nomad-cluster" {
|
|
|
|
|
role_name = "nomad-cluster"
|
|
|
|
|
orphan = true
|
|
|
|
|
renewable = true
|
|
|
|
|
token_explicit_max_ttl = "0"
|
|
|
|
|
token_period = "259200"
|
|
|
|
|
allowed_policies = local.allowed_policies
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
data "vault_policy_document" "nomad_jobs" {
|
|
|
|
|
for_each = toset(local.nomad_policy)
|
|
|
|
|
|
|
|
|
|
rule {
|
|
|
|
|
path = "secrets/data/nomad/${each.key}"
|
|
|
|
|
capabilities = ["read"]
|
|
|
|
|
}
|
|
|
|
|
rule {
|
|
|
|
|
path = "secrets/data/nomad/${each.key}/*"
|
|
|
|
|
capabilities = ["read"]
|
|
|
|
|
}
|
|
|
|
|
rule {
|
|
|
|
|
path = "secrets/data/database/${each.key}"
|
|
|
|
|
capabilities = ["read"]
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
resource "vault_policy" "nomad_jobs" {
|
|
|
|
|
for_each = toset(local.nomad_policy)
|
|
|
|
|
|
|
|
|
|
name = each.key
|
|
|
|
|
policy = data.vault_policy_document.nomad_jobs[each.key].hcl
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
