refactor: reorganize GitOps control plane

2026-07-25 23:55:31 +09:00
parent d507ac6ee9
commit 293ee6fc97
191 changed files with 7046 additions and 9034 deletions
@@ -0,0 +1,101 @@
+variable "auth_db_migration_default_ttl_seconds" {
+  description = "Default TTL for migration credentials."
+  type        = number
+  default     = 3600
+}
+
+variable "auth_db_migration_max_ttl_seconds" {
+  description = "Maximum TTL for migration credentials."
+  type        = number
+  default     = 86400
+}
+
+variable "auth_db_role" {
+  description = "Stable PostgreSQL owner role used by dynamic users."
+  type        = string
+  default     = "project_auth"
+}
+
+variable "database_config_name" {
+  description = "Vault database connection name."
+  type        = string
+  default     = "platform-postgres-dev"
+}
+
+variable "database_mount_path" {
+  description = "Foundation-owned database secrets mount path."
+  type        = string
+  default     = "database"
+}
+
+variable "postgres_admin_password" {
+  description = "PostgreSQL admin password passed only through a write-only provider field."
+  type        = string
+  sensitive   = true
+  ephemeral   = true
+}
+
+variable "postgres_admin_password_version" {
+  description = "Increment whenever postgres_admin_password is rotated."
+  type        = number
+}
+
+variable "postgres_admin_username" {
+  description = "Dedicated database administration username."
+  type        = string
+  default     = "postgres"
+}
+
+variable "postgres_database" {
+  description = "Database in which dynamic migration objects are owned and revoked."
+  type        = string
+  default     = "project_auth"
+}
+
+variable "postgres_host" {
+  description = "Platform PostgreSQL service DNS name."
+  type        = string
+  default     = "postgres.platform.svc.cluster.local"
+}
+
+variable "postgres_operator_default_ttl_seconds" {
+  description = "Default TTL for operator database credentials."
+  type        = number
+  default     = 3600
+}
+
+variable "postgres_operator_max_ttl_seconds" {
+  description = "Maximum TTL for operator database credentials."
+  type        = number
+  default     = 28800
+}
+
+variable "postgres_port" {
+  description = "Platform PostgreSQL service port."
+  type        = number
+  default     = 5432
+}
+
+variable "postgres_sslmode" {
+  description = "PostgreSQL SSL mode. Dev currently uses disable; production must use verify-full."
+  type        = string
+  default     = "disable"
+
+  validation {
+    condition     = contains(["disable", "require", "verify-ca", "verify-full"], var.postgres_sslmode)
+    error_message = "postgres_sslmode must be disable, require, verify-ca, or verify-full."
+  }
+}
+
+variable "vault_addr" {
+  description = "Workload Vault API address."
+  type        = string
+  default     = "http://127.0.0.1:8200"
+}
+
+variable "vault_token" {
+  description = "Short-lived token carrying vault-database-automation-dev."
+  type        = string
+  sensitive   = true
+  ephemeral   = true
+}