57 lines
1.8 KiB
HCL
57 lines
1.8 KiB
HCL
data "ovh_me" "account" {}
|
|
data "ovh_iam_reference_actions" "domain" {
|
|
type = "domain"
|
|
}
|
|
locals {
|
|
domain_read_permissions = [ for a in data.ovh_iam_reference_actions.domain.actions: a if contains(a.categories, "READ") ]
|
|
}
|
|
|
|
resource "ovh_me_api_oauth2_client" "cms" {
|
|
name = "cms repo"
|
|
description = "arcodange.fr management"
|
|
flow = "CLIENT_CREDENTIALS"
|
|
}
|
|
resource "ovh_iam_policy" "cms" {
|
|
name = "cms_manager"
|
|
description = "Permissions related to www.arcodange.fr domain"
|
|
identities = [ovh_me_api_oauth2_client.cms.identity]
|
|
resources = [
|
|
data.ovh_me.account.urn,
|
|
# ovh_me_api_oauth2_client.cms.identity,
|
|
"urn:v1:eu:resource:domain:arcodange.fr",
|
|
]
|
|
# these are all the actions
|
|
allow = concat([
|
|
"account:apiovh:me/get",
|
|
"account:apiovh:me/supportLevel/get",
|
|
"account:apiovh:me/certificates/get",
|
|
"account:apiovh:me/tag/get",
|
|
"account:apiovh:services/get",
|
|
],
|
|
local.domain_read_permissions[*].action,
|
|
[
|
|
"domain:apiovh:nameServer/edit",
|
|
])
|
|
}
|
|
|
|
resource "gitea_repository_actions_secret" "ovh_cms_client_id" {
|
|
repository = data.gitea_repo.cms.name
|
|
repository_owner = data.gitea_repo.cms.username
|
|
secret_name = "OVH_CLIENT_ID"
|
|
secret_value = ovh_me_api_oauth2_client.cms.client_id
|
|
}
|
|
resource "gitea_repository_actions_secret" "ovh_cms_client_secret" {
|
|
repository = data.gitea_repo.cms.name
|
|
repository_owner = data.gitea_repo.cms.username
|
|
secret_name = "OVH_CLIENT_SECRET"
|
|
secret_value = ovh_me_api_oauth2_client.cms.client_secret
|
|
}
|
|
|
|
resource "vault_kv_secret" "ovh_cms_token" {
|
|
path = "kvv1/ovh/cms/app"
|
|
data_json = jsonencode({
|
|
client_id = ovh_me_api_oauth2_client.cms.client_id
|
|
client_secret = ovh_me_api_oauth2_client.cms.client_secret
|
|
urn = ovh_me_api_oauth2_client.cms.identity
|
|
})
|
|
} |