bring unmanaged GCP resources under Terraform

vault-kms.tf: KMS keyring/key for Vault auto-unseal + vault-unseal SA and IAM bindings — all imported from existing GCP resources. prevent_destroy=true on the crypto key to protect against accidental deletion. unmanaged-secrets.tf: 8 secrets that were referenced by live Cloud Run services but had no TF resource — anthropic-api-key, resend-api-key, supabase-service-key, docuseal-webhook-token, stripe-price-professional, stripe-price-founding, stripe-price-family-child, gitea-runner-token. service-account.tf: 4 manually-created SAs — neuron-workspace-dwd, docuseal-storage, analytics-reader, harmonic-search-console.
2026-05-04 09:57:33 -05:00
parent 7e092d4686
commit 89564ccec7
3 changed files with 164 additions and 0 deletions
@@ -0,0 +1,88 @@
+# ── Secrets brought under Terraform management ────────────────────────────────
+# These secrets were created manually (via gcloud or out-of-band provisioning)
+# before the Terraform config was written. Secret values (versions) are NOT
+# managed by Terraform — they were populated out-of-band and are left intact.
+# Terraform owns the secret resource (metadata, replication, IAM) only.
+#
+# All resources here were imported via `terraform import` — they already exist
+# in GCP. Do not add version resources unless you intend to rotate the value.
+
+# ── Marketing / web services ──────────────────────────────────────────────────
+
+resource "google_secret_manager_secret" "anthropic_api_key" {
+  secret_id = "anthropic-api-key"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret" "resend_api_key" {
+  secret_id = "resend-api-key"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret" "supabase_service_key" {
+  secret_id = "supabase-service-key"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret" "docuseal_webhook_token" {
+  secret_id = "docuseal-webhook-token"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+# ── Stripe price IDs (old naming scheme) ─────────────────────────────────────
+# These predate the stripe-price-*-plan naming in stripe-billing.tf.
+# Consumed by marketing-prod-* and accounts-prod-* Cloud Run services.
+
+resource "google_secret_manager_secret" "stripe_price_professional" {
+  secret_id = "stripe-price-professional"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret" "stripe_price_founding" {
+  secret_id = "stripe-price-founding"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret" "stripe_price_family_child" {
+  secret_id = "stripe-price-family-child"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+# ── CI infrastructure ─────────────────────────────────────────────────────────
+
+resource "google_secret_manager_secret" "gitea_runner_token" {
+  secret_id = "gitea-runner-token"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}