configure vault secrets operator

.gitea/workflows/vault.yaml

@@ -2,7 +2,11 @@
 # template source: https://github.com/bretfisher/docker-build-workflow/blob/main/templates/call-docker-build.yaml
 name: Hashicorp Vault
 
-on: [push,pull_request]
+on: #[push,pull_request]
+  push: &vaultPaths
+    paths:
+      - 'hashicorp-vault/**/*.tf'
+  pull_request: *vaultPaths
 
 # cancel any previously-started, yet still active runs of this workflow on the same branch
 concurrency:
@@ -21,6 +25,8 @@ concurrency:
     path: gitea_jwt
     secrets: |
         kvv1/google/credentials credentials | GOOGLE_BACKEND_CREDENTIALS ;
+        kvv1/gitea/app id | TF_VAR_gitea_app_id ;
+        kvv1/postgres/credentials_editor/credentials * | TF_VAR_POSTGRES_CREDENTIALS_EDITOR_ ;
 
 jobs:
   gitea_vault_auth:
@@ -34,44 +40,6 @@ jobs:
         id: gitea_vault_jwt
         run: |
           echo -n "${{ secrets.vault_oauth__sh_b64 }}" | base64 -d | bash
-          echo "### Hello world! :rocket:" >> $GITHUB_STEP_SUMMARY
-      # - name: Step following 'Import Secrets'
-      #   run: |
-      #     echo "${{ env.GOOGLE_BACKEND_CREDENTIALS }}" | base64 -d | jq
-      #     echo $GOOGLE_BACKEND_CREDENTIALS | base64 -d | jq
-      #     echo "${{ steps.vault-secrets.outputs.GOOGLE_BACKEND_CREDENTIALS }}" | base64 -d | jq
-
-      # - uses: actions/checkout@v4
-  
-  # validate:
-  #   runs-on: ubuntu-latest
-  #   name: Validate terraform configuration
-  #   env:
-  #     OPENTOFU_VERSION: 1.8.2
-  #     TERRAFORM_VAULT_AUTH_JWT: ${{ needs.gitea_vault_auth.outputs.access_token }}
-  #   steps:
-  #     - name: Checkout
-  #       uses: actions/checkout@v4
-
-  #     - name: terraform validate
-  #       uses: dflook/terraform-validate@v1
-  #       with:
-  #         path: hashicorp-vault/iac
-
-  # fmt-check:
-  #   runs-on: ubuntu-latest
-  #   name: Check formatting of terraform files
-  #   env:
-  #     OPENTOFU_VERSION: 1.8.2
-  #     TERRAFORM_VAULT_AUTH_JWT: ${{ needs.gitea_vault_auth.outputs.access_token }}
-  #   steps:
-  #     - name: Checkout
-  #       uses: actions/checkout@v4
-
-  #     - name: terraform fmt
-  #       uses: dflook/terraform-fmt-check@v1
-  #       with:
-  #         path: hashicorp-vault/iac
 
   tofu:
     name: Tofu - Vault IAC
@@ -84,23 +52,11 @@ jobs:
     steps:
       - *vault_step
       - uses: actions/checkout@v4
-      - uses: dflook/terraform-plan@v1
-        with:
-          path: hashicorp-vault/iac
-      # - name: terraform apply
-      #   uses: dflook/terraform-apply@v1
+      # - uses: dflook/terraform-plan@v1
       #   with:
       #     path: hashicorp-vault/iac
-
-  # - name: init
-  #   uses: docker://ghcr.io/opentofu/opentofu:latest
-  #   run: |
-  #     tofu -chdir=hashicorp-vault/iac init
-  # - name: plan
-  #   uses: docker://ghcr.io/opentofu/opentofu:latest
-  #   run: |
-  #     tofu -chdir=hashicorp-vault/iac plan -no-color -lock=false
-  # - name: apply
-  #   uses: docker://ghcr.io/opentofu/opentofu:latest
-  #   run: |
-  #     tofu -chdir=hashicorp-vault/iac apply -no-color -auto-approve
+      - name: terraform apply
+        uses: dflook/terraform-apply@v1
+        with:
+          path: hashicorp-vault/iac
+          auto_approve: true