78 lines
2.1 KiB
Terraform
78 lines
2.1 KiB
Terraform
variable "auth_db_migration_default_ttl_seconds" {
|
|
description = "Default TTL for migration credentials."
|
|
type = number
|
|
default = 3600
|
|
}
|
|
|
|
variable "auth_db_migration_max_ttl_seconds" {
|
|
description = "Maximum TTL for migration credentials."
|
|
type = number
|
|
default = 86400
|
|
}
|
|
|
|
variable "auth_db_role" {
|
|
description = "Stable PostgreSQL owner role used by dynamic users."
|
|
type = string
|
|
default = "project_auth"
|
|
}
|
|
|
|
variable "postgres_admin_password" {
|
|
description = "PostgreSQL admin password passed only through a write-only provider field."
|
|
type = string
|
|
sensitive = true
|
|
ephemeral = true
|
|
}
|
|
|
|
variable "postgres_admin_password_version" {
|
|
description = "Increment whenever postgres_admin_password is rotated."
|
|
type = number
|
|
}
|
|
|
|
variable "postgres_admin_username" {
|
|
description = "Dedicated database administration username."
|
|
type = string
|
|
default = "postgres"
|
|
}
|
|
|
|
variable "postgres_database" {
|
|
description = "Database in which dynamic migration objects are owned and revoked."
|
|
type = string
|
|
default = "project_auth"
|
|
}
|
|
|
|
variable "postgres_host" {
|
|
description = "Auth system PostgreSQL service DNS name."
|
|
type = string
|
|
default = "postgres.auth-system-dev.svc.cluster.local"
|
|
}
|
|
|
|
variable "postgres_port" {
|
|
description = "Auth system PostgreSQL service port."
|
|
type = number
|
|
default = 5432
|
|
}
|
|
|
|
variable "postgres_sslmode" {
|
|
description = "PostgreSQL SSL mode. Dev currently uses disable; production must use verify-full."
|
|
type = string
|
|
default = "disable"
|
|
|
|
validation {
|
|
condition = contains(["disable", "require", "verify-ca", "verify-full"], var.postgres_sslmode)
|
|
error_message = "postgres_sslmode must be disable, require, verify-ca, or verify-full."
|
|
}
|
|
}
|
|
|
|
variable "vault_addr" {
|
|
description = "Workload Vault API address."
|
|
type = string
|
|
default = "http://127.0.0.1:8200"
|
|
}
|
|
|
|
variable "vault_token" {
|
|
description = "Short-lived token carrying vault-database-automation-dev."
|
|
type = string
|
|
sensitive = true
|
|
ephemeral = true
|
|
}
|