Restructure: servers/legion/ layout, rename repo to infrastructure

2026-03-23 07:38:42 -05:00
parent 7751eddd73
commit 0b4a236a88
22 changed files with 4 additions and 4 deletions
@@ -0,0 +1,109 @@
+# Vault — secrets management with GCP KMS auto-unseal
+# UI: https://vault.neuralplatform.ai
+# Auto-unseal: GCP KMS projects/neuron-785695/locations/global/keyRings/vault/cryptoKeys/vault-unseal
+
+resource "kubernetes_namespace" "vault" {
+  metadata {
+    name = "vault"
+    labels = {
+      managed-by = "terraform"
+      tier       = "platform"
+    }
+  }
+}
+
+resource "kubernetes_secret" "vault_gcp_sa" {
+  metadata {
+    name      = "vault-gcp-sa"
+    namespace = kubernetes_namespace.vault.metadata[0].name
+  }
+
+  data = {
+    "sa.json" = file("${path.module}/vault-gcp-sa.json")
+  }
+}
+
+resource "helm_release" "vault" {
+  name       = "vault"
+  namespace  = kubernetes_namespace.vault.metadata[0].name
+  repository = "https://helm.releases.hashicorp.com"
+  chart      = "vault"
+  version    = "0.29.1"
+  timeout    = 300
+
+  values = [<<-EOT
+    server:
+      image:
+        repository: hashicorp/vault
+        tag: "1.18.3"
+
+      extraEnvironmentVars:
+        GOOGLE_APPLICATION_CREDENTIALS: /vault/gcp/sa.json
+
+      volumes:
+        - name: gcp-sa
+          secret:
+            secretName: vault-gcp-sa
+
+      volumeMounts:
+        - name: gcp-sa
+          mountPath: /vault/gcp
+          readOnly: true
+
+      ha:
+        enabled: false
+
+      dataStorage:
+        enabled: true
+        size: 10Gi
+
+      standalone:
+        enabled: true
+        config: |
+          ui = true
+
+          listener "tcp" {
+            tls_disable = 1
+            address     = "[::]:8200"
+            cluster_address = "[::]:8201"
+          }
+
+          storage "file" {
+            path = "/vault/data"
+          }
+
+          seal "gcpckms" {
+            project    = "neuron-785695"
+            region     = "global"
+            key_ring   = "vault"
+            crypto_key = "vault-unseal"
+          }
+
+      ingress:
+        enabled: true
+        ingressClassName: traefik
+        annotations:
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: vault.${var.infra_domain}
+            paths:
+              - /
+        tls:
+          - secretName: vault-tls
+            hosts:
+              - vault.${var.infra_domain}
+
+    ui:
+      enabled: true
+
+    injector:
+      enabled: false
+  EOT
+  ]
+
+  depends_on = [
+    kubernetes_secret.vault_gcp_sa,
+    helm_release.cert_manager,
+  ]
+}