pi
d4e9dbf350
The Terraform root module duplicated a writer that the provisioning script could be, and its state carried generated client secrets. Declare the objects in the script instead: project, 19 roles, 12 OIDC apps, applied through the management API with the iam-admin PAT. State is a 0600 JSON file under ~/.config/zitadel. Also add zitadel to the Cloudflare tunnel hostname list, with the import command and the note that the tunnel's Public Hostname entry is a separate dashboard step: DNS alone yields a 404 from the tunnel.
48 lines
1.5 KiB
Terraform
48 lines
1.5 KiB
Terraform
# terraform/edge — the China-facing edge, plus DNS ownership for the existing zone
|
|
#
|
|
# Purpose: give users in mainland China a short, stable path to the homelab
|
|
# without touching the Cloudflare path that serves everyone else.
|
|
#
|
|
# China user -> <service>.<china_domain> -> Tencent CVM (this module)
|
|
# -> WireGuard tunnel -> ingress-nginx (192.168.1.160) -> service
|
|
#
|
|
# Everyone else -> Cloudflare -> cloudflared tunnel -> same ingress (unchanged)
|
|
#
|
|
# The homelab still opens no inbound port: the tunnel is established outbound
|
|
# from the cluster to the CVM.
|
|
#
|
|
# Credentials come from the environment, never from a file in git:
|
|
# export CLOUDFLARE_API_TOKEN=...
|
|
# export TENCENTCLOUD_SECRET_ID=...
|
|
# export TENCENTCLOUD_SECRET_KEY=...
|
|
# terraform -chdir=terraform/edge init
|
|
# terraform -chdir=terraform/edge plan -var china_domain=example.cn ...
|
|
#
|
|
# State is local and git-ignored. It carries no
|
|
# credential today, but it will once InstanceData or certificates are added, so
|
|
# treat it as a secret and move it to MinIO before a second operator applies.
|
|
terraform {
|
|
required_version = ">= 1.6.0"
|
|
|
|
required_providers {
|
|
cloudflare = {
|
|
source = "cloudflare/cloudflare"
|
|
version = "5.28.1"
|
|
}
|
|
tencentcloud = {
|
|
source = "tencentcloudstack/tencentcloud"
|
|
version = "1.83.38"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "cloudflare" {
|
|
api_token = var.cloudflare_api_token
|
|
}
|
|
|
|
provider "tencentcloud" {
|
|
secret_id = var.tencent_secret_id
|
|
secret_key = var.tencent_secret_key
|
|
region = var.tencent_region
|
|
}
|