homelab/terraform/minio.tf

# MinIO - Official minio/minio chart, direct Helm deployment (no operator)
# All-in-one: single helm_release + dedicated xfs StorageClass.
# Why xfs: default `longhorn` SC uses ext4 whose mkfs on 100Gi (~4.5min)
# exceeds kubelet mount timeout. xfs mkfs is near-instant. min.io chart has
# no persistence.fsType, so fsType must be set on the StorageClass.
#
# PVC is Terraform-managed directly (import-only, prevent_destroy) and
# referenced by the chart via persistence.existingClaim, so Helm never
# templates/reconciles the PVC object itself (previously caused a failed
# force-replace attempt against the bound, immutable volumeName).

resource "kubernetes_storage_class" "longhorn_xfs" {
  metadata {
    name = "longhorn-xfs"
  }
  storage_provisioner    = "driver.longhorn.io"
  reclaim_policy         = "Delete"
  allow_volume_expansion = true
  volume_binding_mode    = "Immediate"

  parameters = {
    numberOfReplicas   = "2"
    staleReplicaTimeout = "60"
    fsType             = "xfs"
    dataLocality       = "disabled"
  }
}

resource "kubernetes_persistent_volume_claim" "minio" {
  metadata {
    name      = "minio"
    namespace = "storage"
  }
  spec {
    access_modes       = ["ReadWriteOnce"]
    storage_class_name = kubernetes_storage_class.longhorn_xfs.metadata[0].name
    resources {
      requests = {
        storage = "100Gi"
      }
    }
  }
}

resource "helm_release" "minio" {
  name            = "minio"
  repository      = "https://charts.min.io/"
  chart           = "minio"
  version         = "5.4.0"
  namespace       = "storage"
  upgrade_install = true
  wait            = true
  timeout         = 600

  values = [
    yamlencode({
      mode         = "standalone"
      replicas     = 1
      drivesPerNode = 1
      pools        = 1

      rootUser     = "minioadmin"
      rootPassword = var.minio_root_password

      persistence = {
        enabled       = true
        existingClaim = kubernetes_persistent_volume_claim.minio.metadata[0].name
      }

      resources = {
        requests = {
          memory = "512Mi"
        }
      }

      service = {
        type = "ClusterIP"
        port = "9000"
      }
      consoleService = {
        type = "ClusterIP"
        port = "9001"
      }

      # Buckets auto-created on install (all-in-one, no post-hook needed)
      buckets = [
        { name = "terraform-state", policy = "none", purge = false },
        { name = "vault", policy = "none", purge = false },
        { name = "riotpiao-models", policy = "none", purge = false },
        { name = "loki-chunks", policy = "none", purge = false },
        { name = "loki-ruler", policy = "none", purge = false },
        { name = "loki-admin", policy = "none", purge = false },
        { name = "loki-index", policy = "none", purge = false },
      ]

      environment = {
        MINIO_IDENTITY_OPENID_CONFIG_URL    = "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
        MINIO_IDENTITY_OPENID_CLIENT_ID     = "minio"
        MINIO_IDENTITY_OPENID_CLIENT_SECRET = var.minio_oidc_client_secret
        MINIO_IDENTITY_OPENID_CLAIM_NAME    = "policy"
        MINIO_IDENTITY_OPENID_SCOPES        = "openid,profile,email,minio"
        MINIO_IDENTITY_OPENID_REDIRECT_URI  = "https://minio.riotpiao.homelab.com/oauth_callback"
        MINIO_IDENTITY_OPENID_DISPLAY_NAME  = "Authentik"
      }
    })
  ]
}

variable "create_storage_namespace" {
  description = "Create storage namespace if it doesn't exist"
  type        = bool
  default     = false
}