mirror of
https://github.com/Sea-Haven-Industries/forgejo.git
synced 2026-09-30 05:23:11 +00:00
59 lines
2.4 KiB
Terraform
59 lines
2.4 KiB
Terraform
|
locals {
|
||
|
|
project = "forgejo"
|
||
|
|
account_id = "011934824531"
|
||
|
|
environment = "prod"
|
||
|
|
|
||
|
|
hcp_project = "seahaven-prod"
|
||
|
|
hcp_workspace = "forgejo-prod"
|
||
|
|
apply_role = "hcptf-forgejo"
|
||
|
|
plan_role = "hcptf-forgejo-plan"
|
||
|
|
stack_name = local.project
|
||
|
|
stack_prefix = "forgejo-"
|
||
|
|
|
||
|
|
instance_role_name = "forgejo-instance"
|
||
|
|
instance_profile_name = "forgejo-profile"
|
||
|
|
dlm_role_name = "forgejo-dlm"
|
||
|
|
replication_role_name = "forgejo-s3-replication"
|
||
|
|
lambda_role_name = "forgejo-backup-verification"
|
||
|
|
gcs_user_name = "forgejo-gcs-transfer"
|
||
|
|
boundary_name = "forgejo-exec-boundary"
|
||
|
|
verification_log_group = "/aws/lambda/forgejo-backup-verification"
|
||
|
|
|
||
|
|
vpc_cidr = "10.70.0.0/16"
|
||
|
|
office_vpn_cidr = "10.10.0.0/16"
|
||
|
|
site_alerts_arn = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
|
||
|
|
backup_s3_prefix = "archive"
|
||
|
|
|
||
|
|
backup_bucket_name = "forgejo-backups-${local.account_id}"
|
||
|
|
replica_bucket_name = "forgejo-backups-replica-${local.account_id}"
|
||
|
|
artifacts_bucket_name = "forgejo-lambda-artifacts-${local.account_id}"
|
||
|
|
|
||
|
|
# Name-prefix ARNs. AWS appends a random suffix. hcptf-bootstrap-plan is
|
||
|
|
# ViewOnly and cannot DescribeSecret, so the first plan cannot use a secret
|
||
|
|
# data source. Values are never read.
|
||
|
|
secret_arns = {
|
||
|
|
admin_password = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/admin-password-*"
|
||
|
|
api_token = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/api-token-*"
|
||
|
|
github_pat = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/github-pat-*"
|
||
|
|
gcs_sa_key = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/gcs-sa-key-*"
|
||
|
|
gcs_transfer_credentials = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/gcs-transfer-credentials-*"
|
||
|
|
slack_webhook = "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:forgejo/slack-webhook-*"
|
||
|
|
}
|
||
|
|
|
||
|
|
instance_subnet_id = var.existing_public_subnet_ids[0]
|
||
|
|
|
||
|
|
user_data = replace(
|
||
|
|
replace(
|
||
|
|
replace(
|
||
|
|
file("${path.module}/user_data.sh"),
|
||
|
|
"__FORGEJO_VERSION__",
|
||
|
|
var.forgejo_version,
|
||
|
|
),
|
||
|
|
"__BACKUP_BUCKET__",
|
||
|
|
local.backup_bucket_name,
|
||
|
|
),
|
||
|
|
"__AWS_REGION__",
|
||
|
|
var.aws_region,
|
||
|
|
)
|
||
|
|
}
|