initial commit

terraform/vault-debmini/approles.hcl

@@ -0,0 +1,21 @@
+resource "vault_auth_backend" "approle" {
+   type = "approle"
+}
+
+resource "vault_approle_auth_backend_role" "unifi" {
+  backend = vault_auth_backend.approle.path
+  role_name = "unifi-role"
+  token_policies = ["default", "networking"]
+}
+
+resource "vault_approle_auth_backend_role "iot" {
+  backend = vault_auth_backend.approle.path
+  role_name = "iot-role"
+  token_policies = ["default", "iot"]
+}
+
+resource "vault_approle_auth_backend_role "infra_tools" {
+  backend = vault_auth_backend.approle.path
+  role_name = "infra-role"
+  token_policies = ["default", "infra_tools"]
+}

terraform/vault-debmini/main.tf

@@ -0,0 +1,66 @@
+resource "vault_token" "superuser" {
+  policies = ["super-user"]
+  display_name = "superuser"
+  renewable = true
+  ttl = "768h"
+  metadata = {
+   "purpose" = "service account for managing vault"
+  }
+  lifecycle {
+   create_before_destroy = true
+  }
+}
+
+resource "vault_policy" "super_user" {
+  name = "super-user"
+  policy = <<EOT
+path "sys/policies/acl" {
+    capabilities = ["list"]
+}
+path "sys/policies/acl/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "auth/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/auth/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/auth" {
+    capabilities = ["read"]
+}
+path "identity/*" {
+    capabilities = ["create", "read", "update", "delete", "list"]
+}
+path "secret/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki_root/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki_intermediate/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/leases/*" {
+    capabilities = ["read", "update", "list"]
+}
+path "sys/namespaces/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/mounts" {
+    capabilities = ["read"]
+}
+path "sys/internal/ui/mounts" {
+    capabilities = ["read"]
+}
+path "sys/license" {
+    capabilities = ["create", "read", "update", "delete", "list"]
+}
+path "sys/config/ui" {
+    capabilities = ["read", "update", "delete", "list"]
+}
+EOT
+}

terraform/vault-debmini/policies.tf

@@ -0,0 +1,35 @@
+resource "vault_policy" "infra_tools" {
+  name = "infra_tools"
+  policy = <<EOT
+path "secret/infrastructure/*" {
+    capabilities = ["create", "read", "update", "list", "patch"]
+}
+path "secret/infrastructure" {
+    capabilities = ["read", "list"]
+}
+EOT
+}
+
+resource "vault_policy" "iot" {
+  name = "iot"
+  policy = <<EOT
+path "secret/iot/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "secret/iot" {
+    capabilities = ["read", "list"]
+}
+EOT
+}
+
+resource "vault_policy" "networking" {
+  name = "networking"
+  policy = <<EOT
+path "secret/networking/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "secret/networking" {
+    capabilities = ["read", "list"]
+}
+EOT
+}