rock
091ecdd7bb
Adds terraform/edge, a root module with two providers: - Cloudflare 5.28.1: CNAMEs to the existing tunnel, plus an opt-in resource that can take the tunnel ingress list over when manage_tunnel_config is true. It is off by default because that resource REPLACES the whole list, and the tunnel is remotely managed from the dashboard today. - Tencent Cloud 1.83.38: VPC, subnet, security group with three rules, key pair, one CVM relay with cloud-init (WireGuard listener, forwarding sysctls, Caddy), and DNSPod A records for the .cn hostnames. The design keeps the homelab inbound-free: the relay terminates TLS in China and forwards over a WireGuard tunnel the cluster dials outbound. Cloudflare keeps serving every existing hostname untouched. Verified: terraform init succeeds for both providers, fmt clean, validate reports 0 errors, and plan resolves to 10 creates with placeholder variables. Provider-side name validation caught a real bug during that run: key pair and security group names allow only letters, digits and underscore, so the derived names use underscores. Not applied. Credentials come from CLOUDFLARE_API_TOKEN, TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY; the WireGuard private key is TF_VAR only. State is local and git-ignored like terraform/zitadel. Blocked on facts this module cannot invent: the real .cn domain, whether it has an ICP filing, the CVM image ID, the operator CIDR, and the homelab WireGuard public key.
88 lines
2.5 KiB
Plaintext
88 lines
2.5 KiB
Plaintext
# Environment files — real values must never be committed
|
|
.env
|
|
.env.terraform.sh
|
|
|
|
# Private CA key and generated TLS certs — ca.key must never enter the cluster or git.
|
|
# Only ca.crt is safe to share, but we exclude the whole dir to avoid accidents.
|
|
forge/pki/
|
|
|
|
# Talos machine configs — contain WireGuard private keys, bootstrap tokens, PKI
|
|
cluster-config/controlplane.yaml
|
|
cluster-config/worker*.yaml
|
|
cluster-config/talos-worker*.yaml
|
|
cluster-config/cp-*.yaml
|
|
cluster-config/talos-cp-*.yaml
|
|
cluster-config/secrets.yaml
|
|
cluster-config/talosconfig
|
|
talos-forge-trust.yaml
|
|
# Kubeconfig — contains admin client certificate + private key
|
|
cluster-config/kubeconfig
|
|
|
|
*.html
|
|
LOG.md
|
|
project_context.md
|
|
.claude/*
|
|
|
|
ca.crt
|
|
ca.key
|
|
ca.srl
|
|
|
|
forgejo.crt
|
|
forgejo.key
|
|
forgejo.csr
|
|
|
|
# Compiled test binary — Go produces a native binary named after the directory.
|
|
# Source is k8s/storage/test/main.go; the binary has no place in version control.
|
|
k8s/storage/test/test
|
|
|
|
*.key
|
|
*.conf
|
|
|
|
# CLAUDE.md is now version-controlled (was previously excluded as a
|
|
# private-notes file; contains no secrets - just architecture, IPs
|
|
# [private RFC1918 space], and operational lessons, same bar as README.md).
|
|
|
|
# Terraform state and cache (local files, remote state in MinIO)
|
|
.terraform/
|
|
terraform/.terraform/
|
|
terraform/*.tfstate
|
|
terraform/*.tfstate.*
|
|
# The Zitadel root module keeps its own state (see terraform/zitadel/providers.tf).
|
|
# That state carries generated client secrets and machine keys.
|
|
terraform/zitadel/*.tfstate
|
|
terraform/zitadel/*.tfstate.*
|
|
terraform/zitadel/*.tfvars
|
|
terraform/edge/*.tfstate
|
|
terraform/edge/*.tfstate.*
|
|
terraform/edge/*.tfvars
|
|
terraform/edge/terraform.tfvars.local
|
|
terraform.tfvars.local
|
|
skills-lock.json
|
|
secrets-plaintext.yaml
|
|
|
|
# Saved plan files — binary, environment-specific, may embed resource attributes
|
|
terraform/tfplan
|
|
terraform/tfplan-*
|
|
|
|
.DS_Store
|
|
CLAUDE.md
|
|
docs/
|
|
|
|
bootstrap-argocd.log
|
|
|
|
# Any plaintext (non-SOPS) secret manifest. Encrypted ones are *.enc.yaml and
|
|
# ARE committed — see .sops.yaml. A missing newline once merged two patterns on
|
|
# one line here, which is how a plaintext deploy key reached a public remote.
|
|
k8s/**/*-secret.yaml
|
|
!k8s/**/*.enc.yaml
|
|
|
|
# IAM provisioning scripts contain credential references — never commit
|
|
scripts/iam/*.py
|
|
# Exception: this one reads every credential from the cluster at run time and
|
|
# embeds none. Keep it reviewable in git.
|
|
!scripts/iam/zitadel-provision.py
|
|
|
|
# Runtime credential export from the old Authentik provisioning run. Holds live
|
|
# M2M tokens; never commit it.
|
|
/authentik-m2m-tokens.env
|