forgejo/terraform/locals.tf

locals {
  project     = "forgejo"
  account_id  = "011934824531"
  environment = "prod"

  hcp_project   = "seahaven-prod"
  hcp_workspace = "forgejo-prod"
  apply_role    = "hcptf-forgejo"
  plan_role     = "hcptf-forgejo-plan"
  stack_name    = local.project
  stack_prefix  = "forgejo-"

  instance_role_name     = "forgejo-instance"
  instance_profile_name  = "forgejo-profile"
  dlm_role_name          = "forgejo-dlm"
  replication_role_name  = "forgejo-s3-replication"
  lambda_role_name       = "forgejo-backup-verification"
  gcs_user_name          = "forgejo-gcs-transfer"
  boundary_name          = "forgejo-exec-boundary"
  verification_log_group = "/aws/lambda/forgejo-backup-verification"

  vpc_cidr         = "10.70.0.0/16"
  office_vpn_cidr  = "10.10.0.0/16"
  site_alerts_arn  = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
  backup_s3_prefix = "archive"

  backup_bucket_name    = "forgejo-backups-${local.account_id}"
  replica_bucket_name   = "forgejo-backups-replica-${local.account_id}"
  artifacts_bucket_name = "forgejo-lambda-artifacts-${local.account_id}"

  # Name-prefix ARNs. AWS appends a random suffix. hcptf-bootstrap-plan is
  # ViewOnly and cannot DescribeSecret, so the first plan cannot use a secret
  # data source. Values are never read.
  secret_arns = {
    admin_password           = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/admin-password-*"
    api_token                = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/api-token-*"
    github_pat               = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/github-pat-*"
    gcs_sa_key               = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/gcs-sa-key-*"
    gcs_transfer_credentials = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/gcs-transfer-credentials-*"
    slack_webhook            = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/slack-webhook-*"
  }

  instance_subnet_id = var.existing_public_subnet_ids[0]

  user_data = replace(
    replace(
      replace(
        file("${path.module}/user_data.sh"),
        "__FORGEJO_VERSION__",
        var.forgejo_version,
      ),
      "__BACKUP_BUCKET__",
      local.backup_bucket_name,
    ),
    "__AWS_REGION__",
    var.aws_region,
  )
}