19 lines
867 B
Terraform
19 lines
867 B
Terraform
|
# API applications — the machine-token surface.
|
||
|
|
#
|
||
|
|
# ZITADEL keeps two different objects apart: an OIDC application is for a
|
||
|
|
# browser flow, and an API application is what a client_credentials / JWT-profile
|
||
|
|
# caller presents. Authentik modelled both with one provider, so the plan §1.1
|
||
|
|
# row 1 ("OIDC app + machine user") needs one of each here.
|
||
|
|
#
|
||
|
|
# The gateway signs its token request with the machine key from machines.tf, so
|
||
|
|
# the auth method is PRIVATE_KEY_JWT. No secret is stored for it.
|
||
|
|
|
||
|
|
resource "zitadel_application_api" "machine" {
|
||
|
|
for_each = { for name, spec in local.machine_users : name => spec if contains(keys(var.api_app_consumers), name) }
|
||
|
|
|
||
|
|
org_id = data.zitadel_org.default.id
|
||
|
|
project_id = zitadel_project_v2.homelab.id
|
||
|
|
name = "${each.key}-machine"
|
||
|
|
auth_method_type = "API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT"
|
||
|
|
}
|