viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix DB password desync + migrate remaining tfvars to Vault

Browse source 
DB desync fix: Stacks with Vault DB engine rotation (24h) now read
the password from vault-database ClusterSecretStore instead of vault-kv.
9 stacks updated with db ExternalSecrets reading from static-creds/*.

Stacks fixed: speedtest, hackmd, health, trading-bot, claude-memory,
woodpecker, linkwarden, nextcloud, url.

terraform.tfvars migration:
- plotting-book: google_client_id/secret → Vault KV + secret_key_ref
- tandoor: email_password var removed (was default="", now optional ESO)
- infra: ssh_private_key, vm_wizard_password, dockerhub_registry_password
  → Vault KV at secret/infra + data source
This commit is contained in:
Viktor Barzin 2026-03-15 21:39:45 +00:00 • committed by Viktor Barzin
parent 19e0aef67b
commit fca99fd418
12 changed files with 385 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

27
stacks/plotting-book/main.tf
View file

@ -2,15 +2,6 @@ variable "tls_secret_name" {
type = string
sensitive = true
}
variable "plotting_book_google_client_id" {
type = string
sensitive = true
}
variable "plotting_book_google_client_secret" {
type = string
sensitive = true
}
resource "kubernetes_namespace" "plotting-book" {
metadata {
name = "plotting-book"
@ -125,12 +116,22 @@ resource "kubernetes_deployment" "plotting-book" {
}
}
env {
name = "GOOGLE_CLIENT_ID"
value = var.plotting_book_google_client_id
name = "GOOGLE_CLIENT_ID"
value_from {
secret_key_ref {
name = "plotting-book-secrets"
key = "google_client_id"
}
}
}
env {
name = "GOOGLE_CLIENT_SECRET"
value = var.plotting_book_google_client_secret
name = "GOOGLE_CLIENT_SECRET"
value_from {
secret_key_ref {
name = "plotting-book-secrets"
key = "google_client_secret"
}
}
}
env {
name = "GOOGLE_CALLBACK_URL"