pi
d4e9dbf350
The Terraform root module duplicated a writer that the provisioning script could be, and its state carried generated client secrets. Declare the objects in the script instead: project, 19 roles, 12 OIDC apps, applied through the management API with the iam-admin PAT. State is a 0600 JSON file under ~/.config/zitadel. Also add zitadel to the Cloudflare tunnel hostname list, with the import command and the note that the tunnel's Public Hostname entry is a separate dashboard step: DNS alone yields a 404 from the tunnel.
46 lines
2.4 KiB
Plaintext
46 lines
2.4 KiB
Plaintext
# Copy to terraform.tfvars.local (git-ignored) and fill in.
|
|
# Secrets never belong in a committed file: pass them as environment variables
|
|
# instead — TF_VAR_wireguard_relay_private_key, CLOUDFLARE_API_TOKEN,
|
|
# TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY.
|
|
|
|
# ── Cloudflare (existing zone) ───────────────────────────────────────────────
|
|
cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
|
|
tunnel_id = "REPLACE_WITH_TUNNEL_UUID"
|
|
|
|
# Adopt existing records with `terraform import` before the first apply, or the
|
|
# create call collides with the hand-made record of the same name:
|
|
# terraform import 'cloudflare_dns_record.tunnel["zitadel"]' \
|
|
# <zone_id>/<record_id>
|
|
#
|
|
# A tunnel CNAME is only half of the path. The tunnel's Public Hostname list
|
|
# (Zero Trust -> Networks -> Tunnels -> Public Hostname) must also map the name
|
|
# to https://<name>.riotpiao.com, or Cloudflare answers 404 from the tunnel even
|
|
# though DNS resolves.
|
|
cloudflare_tunnel_hostnames = ["paperless", "img", "poimen", "zitadel"]
|
|
|
|
# Leave false until the tunnel config import is understood. True makes
|
|
# Terraform replace the entire ingress list with tunnel_ingress.
|
|
manage_tunnel_config = false
|
|
tunnel_ingress = {}
|
|
|
|
# ── China edge (Tencent Cloud) ───────────────────────────────────────────────
|
|
china_domain = "REPLACE.example.cn"
|
|
china_hostnames = ["paperless", "img"]
|
|
|
|
# Mainland regions require an ICP filing for the domain. Use ap-hongkong or
|
|
# ap-singapore when no filing exists.
|
|
tencent_region = "ap-guangzhou"
|
|
tencent_availability_zone = "ap-guangzhou-6"
|
|
relay_instance_type = "S5.SMALL2"
|
|
relay_image_id = "REPLACE_WITH_IMAGE_ID"
|
|
relay_ssh_public_key = "ssh-ed25519 AAAA... operator@laptop"
|
|
relay_admin_cidr = "REPLACE_WITH_OPERATOR_CIDR"
|
|
|
|
# ── WireGuard between the relay and the cluster ──────────────────────────────
|
|
# The relay private key comes from `wg genkey`. Keep it in the environment, or
|
|
# in a SOPS file mounted for the run. It is not written by this module.
|
|
wireguard_port = 51820
|
|
wireguard_homelab_public_key = "REPLACE_WITH_HOMELAB_WG_PUBKEY"
|
|
wireguard_relay_address = "10.88.0.1/24"
|
|
wireguard_homelab_address = "10.88.0.2/24"
|