init: 아르고cd, vault 기반 인프라 설계

2026-07-24 14:31:09 +09:00
parent 8879d0a3fe
commit d507ac6ee9
137 changed files with 11431 additions and 1 deletions
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+
+source "${SCRIPT_DIR}/../../vault/dev/provider-lib.sh"
+
+if ! command -v terraform >/dev/null 2>&1; then
+  echo "terraform CLI is required" >&2
+  exit 1
+fi
+
+export VAULT_TRANSIT_ADDR="${VAULT_TRANSIT_ADDR:-${VAULT_ADDR:-http://127.0.0.1:18200}}"
+export TF_VAR_vault_addr="$VAULT_TRANSIT_ADDR"
+export TF_VAR_vault_token="$(provider_vault_token)"
+
+if [[ -n "${SEAL_KEY_NAME:-}" ]]; then
+  export TF_VAR_seal_key_name="$SEAL_KEY_NAME"
+fi
+
+if [[ -n "${SEAL_TOKEN_PERIOD:-}" ]]; then
+  export TF_VAR_seal_token_period="$SEAL_TOKEN_PERIOD"
+fi
+
+if [[ -n "${TARGET_NAMESPACE:-}" ]]; then
+  export TF_VAR_target_namespace="$TARGET_NAMESPACE"
+fi
+
+if [[ -n "${TARGET_SECRET_NAME:-}" ]]; then
+  export TF_VAR_target_secret_name="$TARGET_SECRET_NAME"
+fi
+
+if [[ -n "${WORKFLOW_POLICY_NAME:-}" ]]; then
+  export TF_VAR_workflow_policy_name="$WORKFLOW_POLICY_NAME"
+fi
+
+if [[ -n "${WORKFLOW_ROLE_NAME:-}" ]]; then
+  export TF_VAR_workflow_role_name="$WORKFLOW_ROLE_NAME"
+fi
+
+mkdir -p "${REPO_ROOT}/.terraform-state"
+
+if [[ -n "${TF_STATE_DIR:-}" ]]; then
+  mkdir -p "${TF_STATE_DIR}"
+  terraform -chdir="${REPO_ROOT}/terraform/vault-transit/dev" init \
+    -input=false \
+    -reconfigure \
+    -backend-config="path=${TF_STATE_DIR}/vault-transit-dev.tfstate"
+else
+  terraform -chdir="${REPO_ROOT}/terraform/vault-transit/dev" init -input=false
+fi
+
+terraform -chdir="${REPO_ROOT}/terraform/vault-transit/dev" apply -input=false -auto-approve
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:18200}"
+
+export VAULT_ADDR
+
+if ! command -v vault >/dev/null 2>&1; then
+  echo "vault CLI is required" >&2
+  exit 1
+fi
+
+status_json="$(mktemp)"
+trap 'rm -f "$status_json"' EXIT
+
+if vault status -format=json >"$status_json" 2>/dev/null; then
+  :
+else
+  if [[ ! -s "$status_json" ]]; then
+    echo "Vault transit provider is unreachable at ${VAULT_ADDR}" >&2
+    exit 1
+  fi
+fi
+
+initialized="$(jq -r '.initialized' "$status_json")"
+sealed="$(jq -r '.sealed' "$status_json")"
+
+if [[ "$initialized" != "true" ]]; then
+  echo "Transit provider Vault is not initialized." >&2
+  exit 1
+fi
+
+if [[ "$sealed" == "true" ]]; then
+  cat >&2 <<'EOF'
+Transit provider Vault is sealed.
+Manual unseal is required before the CI reconcile workflow can continue.
+Run the provider Vault runbook from runbooks/vault-transit/dev/README.md and unseal the vault-transit instance first.
+EOF
+  exit 1
+fi
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if ! command -v vault >/dev/null 2>&1; then
+  echo "vault CLI is required" >&2
+  exit 1
+fi
+
+prompt_secret() {
+  local var_name="$1"
+  local label="$2"
+  local value=""
+  local confirm=""
+
+  while true; do
+    read -r -s -p "${label}: " value
+    echo
+    read -r -s -p "${label} (confirm): " confirm
+    echo
+
+    if [[ "$value" != "$confirm" ]]; then
+      echo "Values did not match. Try again." >&2
+      continue
+    fi
+
+    if [[ -z "$value" ]]; then
+      echo "Value must not be empty." >&2
+      continue
+    fi
+
+    printf -v "$var_name" '%s' "$value"
+    break
+  done
+}
+
+prompt_value() {
+  local var_name="$1"
+  local label="$2"
+  local default_value="${3:-}"
+  local value=""
+
+  if [[ -n "$default_value" ]]; then
+    read -r -p "${label} [${default_value}]: " value
+    value="${value:-$default_value}"
+  else
+    read -r -p "${label}: " value
+  fi
+
+  if [[ -z "$value" ]]; then
+    echo "Value must not be empty." >&2
+    exit 1
+  fi
+
+  printf -v "$var_name" '%s' "$value"
+}
+
+echo "Populate provider Vault workload seeds"
+echo "VAULT_ADDR=${VAULT_ADDR:-unset}"
+echo "This script prompts securely so values are not exposed in shell history."
+echo "The workload workflow AppRole bootstrap path is managed by Terraform."
+echo
+
+prompt_secret PLATFORM_POSTGRES_SUPERUSER_PASSWORD "Platform Postgres superuser password"
+prompt_value AUTH_SERVER_DATASOURCE_USERNAME "Postgres auth-server username" "project_auth"
+prompt_secret AUTH_SERVER_DATASOURCE_PASSWORD "Postgres auth-server password"
+prompt_secret PLATFORM_KEYCLOAK_DB_PASSWORD "Postgres keycloak password"
+prompt_secret PLATFORM_KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD "Platform Keycloak bootstrap admin password"
+prompt_secret AUTH_SERVER_KEYCLOAK_CLIENT_SECRET "Keycloak auth-server client secret"
+
+vault kv put kv/dev/workload/platform/postgres/superuser \
+  POSTGRES_SUPERUSER_PASSWORD="$PLATFORM_POSTGRES_SUPERUSER_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/postgres/auth-server \
+  APP_DATASOURCE_USERNAME="$AUTH_SERVER_DATASOURCE_USERNAME" \
+  APP_DATASOURCE_PASSWORD="$AUTH_SERVER_DATASOURCE_PASSWORD" \
+  AUTH_DB_PASSWORD="$AUTH_SERVER_DATASOURCE_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/postgres/keycloak \
+  KEYCLOAK_DB_PASSWORD="$PLATFORM_KEYCLOAK_DB_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/keycloak/bootstrap-admin \
+  KC_BOOTSTRAP_ADMIN_PASSWORD="$PLATFORM_KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/keycloak/client-auth-server \
+  APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET="$AUTH_SERVER_KEYCLOAK_CLIENT_SECRET" \
+  KEYCLOAK_CLIENT_SECRET="$AUTH_SERVER_KEYCLOAK_CLIENT_SECRET" >/dev/null
+
+echo
+echo "Provider Vault workload seed values updated."