e5137e777d
Terraform generates the secrets that have no external meaning
(POSTGRES_PASSWORD, AUTH_SECRET, METRICS_TOKEN, INDEXNOW_KEY) via the random
provider instead of requiring the operator to hand-generate and paste each
into terraform.tfvars. Each is pinned with a static keepers value (secrets.tf)
so apply never regenerates a value already in use - the exact incident class
this guards against: every session invalidated, the app<->DB password
mismatched. Rotation is now a deliberate keepers edit, never a side effect.
postgres_password/auth_secret move from required inputs to optional (default
"") - explicit var wins when supplied (seeding an EXISTING live secret during
a migration onto Terraform, hop-1 cutover runbook Stage 0), else Terraform
generates and owns it. metrics_token/indexnow_key are new: neither existed in
Terraform before, both previously left for the app's own fallback generation.
VAPID deliberately stays a required, non-generated input - an EC keypair
where regeneration breaks every existing push subscription outright, unlike
an opaque token.
Sizing tiers: a locals.sizes t-shirt map (nano/small/medium/large ->
{workers, app_cpus, db_cpus, db_memory}), toward the target Proxmox
sizing-tier model (architecture doc SS6) ahead of actually provisioning VMs -
Proxmox itself stays deferred; today a tier just sizes container caps on the
existing SSH-managed hosts. A host can reference one by name (hosts.<name>.
size) or keep hand-picking the four fields, so existing tfvars are
unaffected; prod's example now uses size = "large" (identical numbers),
beta keeps explicit numbers, and a commented uat example demonstrates the
shortcut for a future ephemeral host.
Strengthened terraform/README.md's local-state caveat: more Terraform-
generated secrets landing in tfstate raises the stakes of the existing
never-commit-cleartext-state guidance, not just the sizing.
Verified: terraform validate + fmt clean. A real `terraform plan` against
fake hosts (prod/beta/uat, mixing size="large"/explicit-numbers/size="nano")
resolved every sizing correctly (prod 8/8/4/16g, beta 4/4/2/8g, uat
1/1/1/1g) and planned exactly one instance of each random_password/random_id
resource. Applied just those four resources (real generation, -target to
avoid touching the fake SSH-only host resources) and re-planned: "No
changes" - confirming the keepers pinning holds. Adding an explicit
postgres_password override afterward left the random_password resource
itself completely untouched (0 replace/destroy), confirming the override
path never disturbs the generated resource.
65 lines
2.8 KiB
HCL
65 lines
2.8 KiB
HCL
# Terraform-generated internal secrets — values with no meaning outside this
|
|
# deployment, so Terraform owns generating them instead of requiring the operator
|
|
# to hand-generate and paste each one into terraform.tfvars.
|
|
#
|
|
# Every resource here is pinned with a static `keepers` value so `terraform
|
|
# apply` never regenerates a value already in use — regeneration would be a real
|
|
# incident (every session invalidated, the app<->DB password mismatched, a
|
|
# bookmarked dashboard token broken). Rotation is a deliberate edit to a
|
|
# resource's `keepers` value here, never a side effect of anything else
|
|
# changing. See docs/architecture/repo-topology-and-infrastructure.md §6.
|
|
#
|
|
# The corresponding variable (variables.tf) defaults to "" (Terraform
|
|
# generates); supply an explicit value only to seed an EXISTING live secret
|
|
# during a migration onto Terraform (hop-1 cutover runbook Stage 0) —
|
|
# `terraform plan` must show no change to the local below once the value
|
|
# matches what's already deployed.
|
|
#
|
|
# VAPID is deliberately NOT here: it's an EC keypair (var.vapid_private_key /
|
|
# vapid_public_key), generated once out-of-band and held as a stable REQUIRED
|
|
# input. Unlike an opaque token, there is no safe "Terraform regenerates it"
|
|
# story — regeneration breaks every existing push subscription outright.
|
|
#
|
|
# Generated values land in tfstate. tfstate must never be committed or synced in
|
|
# cleartext — stand up an encrypted backend (or keep these out of Terraform and
|
|
# supply them as pre-created Swarm secrets instead, per the hop-1 runbook's
|
|
# hazard #15) before relying on this in a shared or remote-state setup.
|
|
|
|
resource "random_password" "postgres_password" {
|
|
length = 32
|
|
special = false # lands raw (no URL-encoding) in THERMOGRAPH_DATABASE_URL
|
|
keepers = {
|
|
rotation = "1"
|
|
}
|
|
}
|
|
|
|
resource "random_id" "auth_secret" {
|
|
byte_length = 32 # matches users.py's own secrets.token_urlsafe(32) fallback shape
|
|
keepers = {
|
|
rotation = "1"
|
|
}
|
|
}
|
|
|
|
resource "random_password" "metrics_token" {
|
|
length = 32
|
|
special = false # may travel as a query param (?token=...); stay URL-safe
|
|
keepers = {
|
|
rotation = "1"
|
|
}
|
|
}
|
|
|
|
resource "random_id" "indexnow_key" {
|
|
byte_length = 16 # 32 hex chars, matching indexnow.py's own secrets.token_hex(16)
|
|
keepers = {
|
|
rotation = "1"
|
|
}
|
|
}
|
|
|
|
locals {
|
|
# var.X wins when explicitly supplied (migration: seed the existing live
|
|
# value); otherwise the Terraform-generated one — see the file header.
|
|
postgres_password = var.postgres_password != "" ? var.postgres_password : random_password.postgres_password.result
|
|
auth_secret = var.auth_secret != "" ? var.auth_secret : random_id.auth_secret.b64_url
|
|
metrics_token = var.metrics_token != "" ? var.metrics_token : random_password.metrics_token.result
|
|
indexnow_key = var.indexnow_key != "" ? var.indexnow_key : random_id.indexnow_key.hex
|
|
}
|