arcodangeandClaude Opus 5
7074a94d7e
Helm Charts / Detect changed charts (push) Successful in 22s
Helm Charts / Detect changed charts (pull_request) Successful in 16s
MinIO / Auth with gitea for vault (push) Failing after 8m33s
MinIO / Tofu - minio IAC (push) Has been skipped
MinIO / Auth with gitea for vault (pull_request) Failing after 8m32s
MinIO / Tofu - minio IAC (pull_request) Has been skipped
Hashicorp Vault / Auth with gitea for vault (pull_request) Failing after 8m32s
Hashicorp Vault / Tofu - Vault IAC (pull_request) Has been skipped
Helm Charts / Library charts tool (push) Has been skipped
Helm Charts / Library charts tool (pull_request) Has been skipped
Hashicorp Vault / Auth with gitea for vault (push) Failing after 8m31s
Hashicorp Vault / Tofu - Vault IAC (push) Has been skipped
Helm Charts / Application charts pgcat (push) Has been skipped
Helm Charts / Application charts pgcat (pull_request) Has been skipped
Les décisions de conception (qui déclare, qui détient, pourquoi les octets ne passent pas par l'API) vivent désormais dans `factory/doc/adr/20260726-stockage-objet-minio.md`. Le code ne garde que ce qu'un relecteur ne peut pas deviner et qui l'empêcherait de casser quelque chose : l'absence VOLONTAIRE de s3:GetObject/PutObject dans la politique du provisionneur, l'absence VOLONTAIRE de basic-auth sur l'ingress S3, le caractère inconditionnel de la règle Vault, et l'avertissement sur les noms d'actions MinIO non éprouvés. Chaque fichier pointe l'ADR. 283 → 230 lignes sur minio/iac. tofu fmt propre, tofu validate réussi sur les deux racines. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01CoafGWmRVESaWX819USUUA
58 lines
1.7 KiB
Terraform
58 lines
1.7 KiB
Terraform
# Module `minio_app` — une app déclare SES buckets depuis SON dépôt.
|
|
# Décisions : factory/doc/adr/20260726-stockage-objet-minio.md
|
|
|
|
resource "minio_s3_bucket" "app" {
|
|
for_each = toset(var.buckets)
|
|
bucket = each.key
|
|
acl = "private" # l'accès passe par des URL présignées
|
|
force_destroy = false # détruire un bucket doit être un geste explicite
|
|
}
|
|
|
|
resource "minio_iam_policy" "app" {
|
|
name = "${var.app}-app"
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
|
|
Resource = [for b in var.buckets : "arn:aws:s3:::${b}/*"]
|
|
},
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["s3:ListBucket", "s3:GetBucketLocation"]
|
|
Resource = [for b in var.buckets : "arn:aws:s3:::${b}"]
|
|
},
|
|
]
|
|
})
|
|
}
|
|
|
|
resource "random_password" "app" {
|
|
length = 40
|
|
special = false # les outils S3 transportent mal certains caractères en URL
|
|
}
|
|
|
|
resource "minio_iam_user" "app" {
|
|
name = "${var.app}-app"
|
|
secret = random_password.app.result
|
|
force_destroy = false # une rotation ne recrée pas l'utilisateur : les objets gardent leur propriétaire
|
|
}
|
|
|
|
resource "minio_iam_user_policy_attachment" "app" {
|
|
user_name = minio_iam_user.app.id
|
|
policy_name = minio_iam_policy.app.id
|
|
}
|
|
|
|
# Lu par le pod de l'app — `app_policy` lui accorde déjà ce chemin.
|
|
resource "vault_kv_secret_v2" "app" {
|
|
mount = "kvv2"
|
|
name = "minio/${var.app}"
|
|
data_json = jsonencode({
|
|
MINIO_ENDPOINT = var.endpoint
|
|
MINIO_BUCKET = var.buckets[0]
|
|
MINIO_BUCKETS = join(",", var.buckets)
|
|
MINIO_ACCESS_KEY = minio_iam_user.app.id
|
|
MINIO_SECRET_KEY = random_password.app.result
|
|
})
|
|
}
|