infrastructure/main.tf at master · angelnu/infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

terraform {
  required_providers {
    sops = {
      source  = "carlpett/sops"
      version = "1.4.1"
    }
  }
}

data "sops_file" "network_clients" {
  source_file = "${path.module}/settings/network_clients.yaml"
}

data "sops_file" "settings_secrets" {
  source_file = "${path.module}/settings/secrets.yaml"
}

module "unifi" {
  source = "./terraform/unifi"

  network_clients     = yamldecode(nonsensitive(data.sops_file.network_clients.raw))
  unifi_api_url       = data.sops_file.settings_secrets.data["unifi.api.url"]
  unifi_api_insecure  = data.sops_file.settings_secrets.data["unifi.api.insecure"]
  unifi_api_username  = data.sops_file.settings_secrets.data["unifi.api.username"]
  unifi_api_password  = data.sops_file.settings_secrets.data["unifi.api.password"]
  unifi_wlan_password = data.sops_file.settings_secrets.data["unifi.wlan.password"]
}

# module "openwrt" {
#   source = "./terraform/openwrt"

#   network_clients = yamldecode(nonsensitive(data.sops_file.network_clients.raw))
#   router_IP       = "192.168.2.1"
#   router_ssh_key  = file("~/.ssh/id_rsa")
#   dnsmasq_config_extra = nonsensitive(data.sops_file.settings_secrets.data["openwrt.dnsmasq_config_extra"])
# }

data "sops_file" "authentik" {
  source_file = "${path.module}/settings/authentik.yaml"
}
module "authentik" {
  source               = "./terraform/authentik"
  cluster_settings     = yamldecode(nonsensitive(data.sops_file.authentik.raw)).clusters.prod
  cluster_domain       = format("prod.%s", nonsensitive(data.sops_file.settings_secrets.data["main_home_domain"]))
  cluster_short_domain = nonsensitive(data.sops_file.settings_secrets.data["main_home_domain"])
  authentik_users      = yamldecode(nonsensitive(data.sops_file.authentik.raw)).users
  authentik_groups     = yamldecode(nonsensitive(data.sops_file.authentik.raw)).groups
  authentik_config     = yamldecode(nonsensitive(data.sops_file.authentik.raw))
}
module "authentik-test" {
  source               = "./terraform/authentik"
  cluster_settings     = yamldecode(nonsensitive(data.sops_file.authentik.raw)).clusters.test
  cluster_domain       = format("test.%s", nonsensitive(data.sops_file.settings_secrets.data["main_home_domain"]))
  cluster_short_domain = format("test.%s", nonsensitive(data.sops_file.settings_secrets.data["main_home_domain"]))
  authentik_users      = yamldecode(nonsensitive(data.sops_file.authentik.raw)).users
  authentik_groups     = yamldecode(nonsensitive(data.sops_file.authentik.raw)).groups
  authentik_config     = yamldecode(nonsensitive(data.sops_file.authentik.raw))
}

data "sops_file" "domains" {
  source_file = "${path.module}/settings/domains.yaml"
}
module "dnsmadeeasy" {
  source         = "./terraform/dnsmadeeasy"
  api_key        = data.sops_file.settings_secrets.data["dnsmadeeasy.credentials.api_key"]
  secret_key     = data.sops_file.settings_secrets.data["dnsmadeeasy.credentials.secret_key"]
  domains        = yamldecode(nonsensitive(data.sops_file.domains.raw)).domains
  domains_common = yamldecode(nonsensitive(data.sops_file.domains.raw)).common
}

data "sops_file" "vyos" {
  source_file = "${path.module}/settings/vyos.yaml"
}
module "vyos" {
  source = "./terraform/vyos"

  config          = yamldecode(nonsensitive(data.sops_file.vyos.raw))
  network_clients = yamldecode(nonsensitive(data.sops_file.network_clients.raw))
  domains         = yamldecode(nonsensitive(data.sops_file.domains.raw)).domains
  domains_common  = yamldecode(nonsensitive(data.sops_file.domains.raw)).common
}

module "proxmox" {
  source = "./terraform/proxmox"

  config          = yamldecode(nonsensitive(data.sops_file.settings_secrets.raw)).proxmox
  network_clients = yamldecode(nonsensitive(data.sops_file.network_clients.raw))
  lan_config      = yamldecode(nonsensitive(data.sops_file.vyos.raw)).common.networks.lan
}