create gitea tofu bot user

iac/backend.tf

@@ -1,6 +1,6 @@
 terraform {
   backend "gcs" {
     bucket  = "arcodange-tf"
-    prefix  = "tofu/code"
+    prefix  = "factory/main"
   }
 }

iac/main.tf

@@ -0,0 +1,31 @@
+
+resource "random_password" "tofu" {
+  length           = 32
+}
+resource "gitea_user" "tofu" {
+  username             = "tofu_module_reader"
+  login_name           = "tofu_module_reader"
+  password             = random_password.tofu.result
+  email                = "tofu-module-reader@arcodange.fake"
+  must_change_password = false
+  full_name = "restricted CI user"
+  prohibit_login = true
+  restricted = true
+  visibility = "private"
+}
+resource "tls_private_key" "tofu" {
+  algorithm =  "ED25519"
+}
+resource "gitea_public_key" "tofu" {
+  title     = "tofu"
+  key       = tls_private_key.tofu.public_key_openssh
+  username  = gitea_user.tofu.username
+}
+
+resource "vault_kv_secret" "gitea_admin_token" {
+  path = "kvv1/gitea/tofu_module_reader"
+  data_json = jsonencode({
+    ssh_private_key = tls_private_key.tofu.private_key_openssh
+    ssh_public_key = tls_private_key.tofu.public_key_openssh
+  })
+}

iac/providers.tf

@@ -0,0 +1,25 @@
+terraform {
+  required_providers {
+    gitea = {
+      source = "go-gitea/gitea"
+      version = "0.5.1"
+    }
+    vault = {
+      source = "vault"
+      version = "4.4.0"
+    }
+  }
+}
+
+provider "gitea" { # https://registry.terraform.io/providers/go-gitea/gitea/latest/docs
+  base_url = "https://gitea.arcodange.duckdns.org"
+  # use GITEA_TOKEN env var
+}
+
+provider vault {
+  address = "https://vault.arcodange.duckdns.org"
+  auth_login_jwt { # TERRAFORM_VAULT_AUTH_JWT environment variable
+    mount = "gitea_jwt"
+    role = "gitea_cicd"
+  }
+}