feat(ci,iac): Consolidate Forgejo CI workflows and add Talos Terraform IaC

Consolidate three separate Forgejo Actions (argocd-sync, security-scan, validate-k8s) into single cluster-ci workflow for cleaner CI/CD pipeline with proper job sequencing and reduced auth overhead. Add Terraform configuration for Talos cluster machine configs: - Provider setup for Talos - Centralized variables for CP and worker configs - Template-based config generation for controlplane.yaml and worker-*.yaml - Sensitive data separated in terraform.tfvars (gitignored) - Local state tracking for infrastructure
2026-07-17 23:44:08 -07:00
parent 7437078f23
commit c6493f14ae
14 changed files with 831 additions and 876 deletions
@@ -0,0 +1,168 @@
+variable "talos_version" {
+  type        = string
+  default     = "v1.13.3"
+  description = "Talos version"
+}
+
+variable "kubernetes_version" {
+  type        = string
+  default     = "v1.36.1"
+  description = "Kubernetes version"
+}
+
+variable "cluster_name" {
+  type        = string
+  default     = "homelab-cluster"
+  description = "Cluster name"
+}
+
+variable "cluster_id" {
+  type        = string
+  sensitive   = true
+  description = "Globally unique cluster ID (base64 encoded)"
+}
+
+variable "cluster_secret" {
+  type        = string
+  sensitive   = true
+  description = "Shared cluster secret (base64 encoded)"
+}
+
+variable "bootstrap_token" {
+  type        = string
+  sensitive   = true
+  description = "Bootstrap token for joining cluster"
+}
+
+variable "machine_token" {
+  type        = string
+  sensitive   = true
+  description = "Machine PKI token"
+}
+
+variable "machine_ca_crt" {
+  type        = string
+  sensitive   = true
+  description = "Machine CA certificate (base64 encoded)"
+}
+
+variable "machine_ca_key" {
+  type        = string
+  sensitive   = true
+  description = "Machine CA private key (base64 encoded)"
+}
+
+variable "kubernetes_ca_crt" {
+  type        = string
+  sensitive   = true
+  description = "Kubernetes CA certificate (base64 encoded)"
+}
+
+variable "kubernetes_ca_key" {
+  type        = string
+  sensitive   = true
+  description = "Kubernetes CA private key (base64 encoded)"
+}
+
+variable "etcd_ca_crt" {
+  type        = string
+  sensitive   = true
+  description = "Etcd CA certificate (base64 encoded)"
+}
+
+variable "etcd_ca_key" {
+  type        = string
+  sensitive   = true
+  description = "Etcd CA private key (base64 encoded)"
+}
+
+variable "aggregator_ca_crt" {
+  type        = string
+  sensitive   = true
+  description = "Aggregator CA certificate (base64 encoded)"
+}
+
+variable "aggregator_ca_key" {
+  type        = string
+  sensitive   = true
+  description = "Aggregator CA private key (base64 encoded)"
+}
+
+variable "service_account_key" {
+  type        = string
+  sensitive   = true
+  description = "Service account private key (base64 encoded)"
+}
+
+variable "secretbox_encryption_secret" {
+  type        = string
+  sensitive   = true
+  description = "Secretbox encryption secret (base64 encoded)"
+}
+
+variable "controlplane_config" {
+  type = object({
+    hostname     = string
+    lan_ip       = string
+    lan_subnet   = string
+    lan_gateway  = string
+    wg0_ip       = string
+    wg0_subnet   = string
+    wg0_port     = number
+    wg0_peers    = list(object({
+      public_key      = string
+      allowed_ips     = list(string)
+    }))
+    wg1_ip       = string
+    wg1_subnet   = string
+    wg1_port     = number
+    wg1_peers    = list(object({
+      public_key                = string
+      allowed_ips               = list(string)
+      persistent_keepalive_secs = number
+    }))
+    wg0_private_key = string
+    wg1_private_key = string
+    install_disk = string
+    longhorn_disks = list(object({
+      device     = string
+      mountpoint = string
+    }))
+  })
+  description = "Control plane machine configuration"
+}
+
+variable "worker_configs" {
+  type = map(object({
+    hostname    = string
+    lan_ip      = string
+    lan_subnet  = string
+    lan_gateway = string
+    install_disk = string
+    node_labels = map(string)
+  }))
+  description = "Worker machine configurations"
+}
+
+variable "cluster_config" {
+  type = object({
+    controlplane_ip = string
+    pod_subnets     = list(string)
+    service_subnets = list(string)
+    dns_servers     = list(string)
+    dns_domain      = string
+  })
+  description = "Cluster-wide configuration"
+}
+
+variable "forgejo_registry_ip" {
+  type        = string
+  default     = "10.107.155.96"
+  description = "Forgejo registry (container repo) ClusterIP for host DNS rewrite"
+}
+
+variable "forgejo_hostname" {
+  type        = string
+  default     = "forgejo.riotpiao.homelab.com"
+  description = "Forgejo external hostname"
+}