47 lines
1.9 KiB
Terraform
47 lines
1.9 KiB
Terraform
|
# Outputs feed two things: the SOPS re-point of consumer secrets (§3.2, §6.9)
|
||
|
|
# and the machine-key handoff to each agent workload (§5.3). Every value that can
|
||
|
|
# authenticate a client is marked sensitive, so `terraform output` prints a
|
||
|
|
# placeholder until you ask for it explicitly.
|
||
|
|
|
||
|
|
output "org_id" {
|
||
|
|
description = "Organization that owns the project, roles and applications."
|
||
|
|
value = data.zitadel_org.default.id
|
||
|
|
}
|
||
|
|
|
||
|
|
output "project_id" {
|
||
|
|
description = "Project ID, which ZITADEL puts in the access-token `aud` claim."
|
||
|
|
value = zitadel_project_v2.homelab.id
|
||
|
|
}
|
||
|
|
|
||
|
|
output "client_ids" {
|
||
|
|
description = "client_id per consumer. Compare against the Authentik values: any difference means the consumer config must change too."
|
||
|
|
value = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_id }
|
||
|
|
}
|
||
|
|
|
||
|
|
output "client_secrets" {
|
||
|
|
description = "Generated client secret per consumer. Write these into the existing SOPS files; never into git."
|
||
|
|
value = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_secret }
|
||
|
|
sensitive = true
|
||
|
|
}
|
||
|
|
|
||
|
|
output "api_app_client_ids" {
|
||
|
|
description = "client_id of each API application (machine-token surface)."
|
||
|
|
value = { for name, app in zitadel_application_api.machine : name => app.client_id }
|
||
|
|
}
|
||
|
|
|
||
|
|
output "machine_user_ids" {
|
||
|
|
description = "ZITADEL user ID per machine user."
|
||
|
|
value = { for name, user in zitadel_machine_user.agent : name => user.id }
|
||
|
|
}
|
||
|
|
|
||
|
|
output "machine_keys" {
|
||
|
|
description = "JWT profile key JSON per machine user. Mount as a file; do not pass through the environment."
|
||
|
|
value = { for name, key in zitadel_machine_key.agent : name => key.key_details }
|
||
|
|
sensitive = true
|
||
|
|
}
|
||
|
|
|
||
|
|
output "groups_claim_enabled" {
|
||
|
|
description = "Whether the groups-claim action and its triggers exist. False means Option A is not yet in place and no consumer may move."
|
||
|
|
value = var.enable_groups_claim_action
|
||
|
|
}
|