rock
f81ff0e2fc
Adds terraform/zitadel: the provisioning half the ArgoCD wiring left open. It declares 1 project, 19 project roles, 12 OIDC applications, 5 machine users plus keys, one API application for the gateway, project grants, per-agent claim metadata, and a disabled groups-claim action. Facts established while writing it: - Client IDs cannot be preserved. ZITADEL v4.19.2 CreateOIDCApplicationRequest has no client_id field, and provider 3.8.7 rejects a settable application id (terraform validate reports "Invalid or unknown key"). Plan §3.2 assumed a client_id-preserving re-point; every consumer now also changes client ID. - Role keys equal the existing group names, so the groups claim can be byte-identical and no RBAC file changes. v4.19.2 allows role keys of 1-200 characters with no character-set restriction. - Machine users get JWT profile keys, not passwords. Per-agent claims move to user metadata and reach tokens only through the groups-claim action. - The action stays gated: enable_groups_claim_action defaults to false because the action runtime API is unverified. Two validations stop a null script from reaching file(). Checks: terraform fmt -check -recursive clean, terraform validate 0 errors, plan reaches only the expected missing-credentials error, structural gate 0 error / 0 warning, and one reviewer round: BLOCK on a plan-time fileexists(null) and on the missing api-gw machine path, both fixed, re-reviewed to SIGN-OFF. State is local and git-ignored; it carries generated client secrets and machine keys. Move it to MinIO before a second operator applies. Not applied: no Zitadel instance is running yet.
77 lines
2.1 KiB
Plaintext
77 lines
2.1 KiB
Plaintext
# Environment files — real values must never be committed
|
|
.env
|
|
.env.terraform.sh
|
|
|
|
# Private CA key and generated TLS certs — ca.key must never enter the cluster or git.
|
|
# Only ca.crt is safe to share, but we exclude the whole dir to avoid accidents.
|
|
forge/pki/
|
|
|
|
# Talos machine configs — contain WireGuard private keys, bootstrap tokens, PKI
|
|
cluster-config/controlplane.yaml
|
|
cluster-config/worker*.yaml
|
|
cluster-config/talos-worker*.yaml
|
|
cluster-config/cp-*.yaml
|
|
cluster-config/talos-cp-*.yaml
|
|
cluster-config/secrets.yaml
|
|
cluster-config/talosconfig
|
|
talos-forge-trust.yaml
|
|
# Kubeconfig — contains admin client certificate + private key
|
|
cluster-config/kubeconfig
|
|
|
|
*.html
|
|
LOG.md
|
|
project_context.md
|
|
.claude/*
|
|
|
|
ca.crt
|
|
ca.key
|
|
ca.srl
|
|
|
|
forgejo.crt
|
|
forgejo.key
|
|
forgejo.csr
|
|
|
|
# Compiled test binary — Go produces a native binary named after the directory.
|
|
# Source is k8s/storage/test/main.go; the binary has no place in version control.
|
|
k8s/storage/test/test
|
|
|
|
*.key
|
|
*.conf
|
|
|
|
# CLAUDE.md is now version-controlled (was previously excluded as a
|
|
# private-notes file; contains no secrets - just architecture, IPs
|
|
# [private RFC1918 space], and operational lessons, same bar as README.md).
|
|
|
|
# Terraform state and cache (local files, remote state in MinIO)
|
|
.terraform/
|
|
terraform/.terraform/
|
|
terraform/*.tfstate
|
|
terraform/*.tfstate.*
|
|
# The Zitadel root module keeps its own state (see terraform/zitadel/providers.tf).
|
|
# That state carries generated client secrets and machine keys.
|
|
terraform/zitadel/*.tfstate
|
|
terraform/zitadel/*.tfstate.*
|
|
terraform/zitadel/*.tfvars
|
|
terraform.tfvars.local
|
|
skills-lock.json
|
|
secrets-plaintext.yaml
|
|
|
|
# Saved plan files — binary, environment-specific, may embed resource attributes
|
|
terraform/tfplan
|
|
terraform/tfplan-*
|
|
|
|
.DS_Store
|
|
CLAUDE.md
|
|
docs/
|
|
|
|
bootstrap-argocd.log
|
|
|
|
# Any plaintext (non-SOPS) secret manifest. Encrypted ones are *.enc.yaml and
|
|
# ARE committed — see .sops.yaml. A missing newline once merged two patterns on
|
|
# one line here, which is how a plaintext deploy key reached a public remote.
|
|
k8s/**/*-secret.yaml
|
|
!k8s/**/*.enc.yaml
|
|
|
|
# IAM provisioning scripts contain credential references — never commit
|
|
scripts/iam/*.py
|