cloudflare management for cms

iac/cloudflare_ovh_cms.tf

@@ -0,0 +1,76 @@
+data "cloudflare_account" "arcodange" {
+  filter = {
+    name = "arcodange@gmail.com"
+  }
+}
+
+locals {
+  cloudflare_account_id = data.cloudflare_account.arcodange.account_id
+}
+
+resource "cloudflare_r2_bucket" "arcodange_tf" {
+  account_id   = local.cloudflare_account_id
+  name         = "arcodange-tf"
+  jurisdiction = "eu"
+}
+
+module "cf_r2_arcodange_tf_token" {
+  source     = "./modules/cloudflare_token"
+  account_id = local.cloudflare_account_id
+  bucket     = cloudflare_r2_bucket.arcodange_tf
+  token_name = "r2_arcodange_tf_token"
+  permissions = {
+    bucket = [
+      "account:Workers R2 Storage Read",
+      "bucket:Workers R2 Storage Bucket Item Write",
+    ]
+  }
+}
+resource "vault_kv_secret" "cf_r2_arcodange_tf" {
+  path = "kvv1/cloudflare/r2/arcodange-tf"
+  data_json = jsonencode({
+    S3_SECRET_ACCESS_KEY = module.cf_r2_arcodange_tf_token.r2_credentials.secret_access_key
+    S3_ACCESS_KEY        = module.cf_r2_arcodange_tf_token.r2_credentials.access_key_id
+  })
+}
+
+data "vault_policy_document" "cf_r2_arcodange_tf" {
+  rule {
+    path         = "kvv1/cloudflare/r2/arcodange-tf"
+    capabilities = ["read"]
+  }
+}
+resource "vault_policy" "cf_r2_arcodange_tf" {
+  name   = "factory__cf_r2_arcodange_tf"
+  policy = data.vault_policy_document.cf_r2_arcodange_tf.hcl
+}
+
+data "gitea_repo" "cms" {
+  name     = "cms"
+  username = "arcodange-org"
+}
+module "cf_arcodange_cms_token" {
+  source     = "./modules/cloudflare_token"
+  account_id = local.cloudflare_account_id
+  bucket     = cloudflare_r2_bucket.arcodange_tf
+  token_name = "cf_arcodange_cms_token"
+  permissions = {
+    account = [
+      "account:Pages Write",
+      "account:Account DNS Settings Write",
+    ]
+  }
+}
+resource "gitea_repository_actions_secret" "cf_arcodange_cms_token" {
+  repository       = data.gitea_repo.cms.name
+  repository_owner = data.gitea_repo.cms.username
+  secret_name      = "CLOUDFLARE_API_TOKEN"
+  secret_value     = module.cf_arcodange_cms_token.token
+}
+
+resource "vault_kv_secret" "cf_arcodange_cms_token" {
+  path = "kvv1/cloudflare/cms/cf_arcodange_cms_token"
+  data_json = jsonencode({
+    token = module.cf_arcodange_cms_token.token
+  })
+}