lab/iac
1
0
Fork 0
Code Issues 11 Pull requests 3 Projects Releases Packages Wiki Activity Actions
No description
61 commits 4 branches 0 tags 188 KiB
  • HCL 66.9%
  • Python 19.9%
  • Shell 13.2%
Find a file
Exact
Hunter Egnatis 7d494668ab update privatemedia redirect uri
2026-09-19 15:07:30 -04:00
apps T1: fix provider resolution + catalog schema (#3) 2026-08-11 11:27:23 -04:00
argocd T7: rename argo root to argocd 2026-08-11 16:26:18 -04:00
docs T7: rename argo root to argocd 2026-08-11 16:26:18 -04:00
forgejo T3: forgejo org/repos/teams module (#4) 2026-08-11 11:45:03 -04:00
k8s T4: align RoleBinding subjects with hyphenated kanidm group names 2026-08-11 14:37:28 -04:00
kanidm update privatemedia redirect uri 2026-09-19 15:07:30 -04:00
plans docs: update GitRepository source name from vault-infra to iac 2026-08-10 12:29:57 -04:00
scripts T7: rename argo root to argocd 2026-08-11 16:26:18 -04:00
vault T40: replace en dash with hyphen to avoid ambiguous unicode 2026-08-14 22:07:26 -04:00
.gitignore feat(kanidm): adopt groups and oauth2 clients via tofu 2026-08-10 12:17:05 -04:00
AGENTS.md chore(agents): forbid local tofu/terraform apply — all applies via the tofu runner 2026-08-12 11:38:28 -04:00
CONTEXT.md T7: rename argo root to argocd 2026-08-11 16:26:18 -04:00
README.md T7: rename argo root to argocd 2026-08-11 16:26:18 -04:00
Taskfile.yaml T7: rename argo root to argocd 2026-08-11 16:26:18 -04:00

README.md

IaC Repo

Terraform/OpenTofu managed infrastructure for animeteamspeak lab.

Structure

  • apps/ - central app catalogue apps/catalog.yaml driving all systems
  • kanidm/ - Kanidm groups and OAuth2 clients
    • modules/dev_groups/ - per-app capability groups group-<app>-<capability>
  • vault/ - Vault platform config
    • modules/app_secrets/ - per-app policies and KV paths (VSO read path, ADR-0004)
  • k8s/ - Kubernetes resources via Terraform
    • modules/tenant/ - namespace/RBAC scaffolding per app
  • forgejo/ - Forgejo org/repo/team management
    • modules/app/ - org, repos, and ADR-0007 capability teams per app
  • argocd/ - Argo CD AppProject RBAC (ADR-0007), live per-app projects
    • modules/app_roles/ - catalog → per-app AppProject-role input shape (T6)
    • argocd_project per app; roles bind capability groups via roles[].groups
  • scripts/ - validation helpers (e.g. validate-argocd-rbac.sh, run as task validate-argocd-rbac)

Accessing Argo CD

The argocd/ root uses the argoproj-labs/argocd provider against argocd.animeteamspeak.moe. Authenticate as a Kanidm service account:

# RFC 8693 exchange: SA API token -> id_token for the argocd client
export ARGOCD_AUTH_TOKEN="$(kanidm/scripts/kanidm-login.py --client argocd --api-token "$SA_TOKEN")"

The provider reads ARGOCD_AUTH_TOKEN (or var.argocd_auth_token).

Naming convention

Per-app capability groups: group-<app>-<capability> where capability ∈ viewer, contributor, developer, maintainer, live-debugging, generated-secret-manager, manual-secret-manager, k8s-secret-viewer (ADR-0006). Hyphen separators keep the group names DNS-1123-safe (k8s object-name validity), so the same string serves as the kanidm group name, the RoleBinding subject, and the k8s Role name. <app>-root is a derived nested group (ADR-0007), not a flat entry.

org per app, dynamic Forgejo group mapping enabled. hello from testpr