Patrick de Ruiter
9c0d389dd3
- Migrated Ansible integration from consul_template to vault_agent - Copied vault_agent role from terraform-vsphere-infra module - Created vault_agent-playbook.yml for deployment - Archived consul_template role as consul_template-legacy - Updated Terraform configuration: - Changed Ansible inventory group from consul_template to vault_agent - Added vault_secret_path variable for vault-agent - Added ssl_certs_dir and ssl_private_dir variables - Formatted all Terraform files - Implemented CI/CD pipeline: - Created .gitea/workflows/pipeline.yaml - Added TFLint, Tfsec, and Checkov security scans - Added Terraform validate step - Added SonarQube integration - Created sonar-project.properties - Documentation updates: - Updated README.md with vault-agent information - Added migration section comparing consul-template vs vault-agent - Updated CLAUDE.md with vault-agent architecture - Added vault-agent configuration examples Why vault-agent over consul-template: - Full AppRole support with role_id/secret_id files - Advanced token auto-renewal with auto_auth - Better credential security (separate files vs config) - Actively developed by HashiCorp Note: The ansible/ directory changes (vault_agent role and playbook) are not committed as the directory is in .gitignore. These files exist locally and will be deployed during Ansible runs.
22 lines
600 B
HCL
22 lines
600 B
HCL
terraform {
|
|
backend "s3" {
|
|
endpoints = {
|
|
s3 = "https://minio.bsdserver.nl:443"
|
|
}
|
|
|
|
bucket = "home-terraform"
|
|
key = "home/security/encryption/certificate-automation.tfstate"
|
|
|
|
# Configure credentials via environment variables:
|
|
# export AWS_ACCESS_KEY_ID="your-access-key"
|
|
# export AWS_SECRET_ACCESS_KEY="your-secret-key"
|
|
|
|
region = "main"
|
|
skip_credentials_validation = true
|
|
skip_metadata_api_check = true
|
|
skip_requesting_account_id = true
|
|
skip_region_validation = true
|
|
use_path_style = true
|
|
}
|
|
}
|