Will Anderson
89564ccec7
vault-kms.tf: KMS keyring/key for Vault auto-unseal + vault-unseal SA and IAM bindings — all imported from existing GCP resources. prevent_destroy=true on the crypto key to protect against accidental deletion. unmanaged-secrets.tf: 8 secrets that were referenced by live Cloud Run services but had no TF resource — anthropic-api-key, resend-api-key, supabase-service-key, docuseal-webhook-token, stripe-price-professional, stripe-price-founding, stripe-price-family-child, gitea-runner-token. service-account.tf: 4 manually-created SAs — neuron-workspace-dwd, docuseal-storage, analytics-reader, harmonic-search-console.
89 lines
2.6 KiB
Terraform
89 lines
2.6 KiB
Terraform
# ── Secrets brought under Terraform management ────────────────────────────────
|
|
# These secrets were created manually (via gcloud or out-of-band provisioning)
|
|
# before the Terraform config was written. Secret values (versions) are NOT
|
|
# managed by Terraform — they were populated out-of-band and are left intact.
|
|
# Terraform owns the secret resource (metadata, replication, IAM) only.
|
|
#
|
|
# All resources here were imported via `terraform import` — they already exist
|
|
# in GCP. Do not add version resources unless you intend to rotate the value.
|
|
|
|
# ── Marketing / web services ──────────────────────────────────────────────────
|
|
|
|
resource "google_secret_manager_secret" "anthropic_api_key" {
|
|
secret_id = "anthropic-api-key"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|
|
|
|
resource "google_secret_manager_secret" "resend_api_key" {
|
|
secret_id = "resend-api-key"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|
|
|
|
resource "google_secret_manager_secret" "supabase_service_key" {
|
|
secret_id = "supabase-service-key"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|
|
|
|
resource "google_secret_manager_secret" "docuseal_webhook_token" {
|
|
secret_id = "docuseal-webhook-token"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|
|
|
|
# ── Stripe price IDs (old naming scheme) ─────────────────────────────────────
|
|
# These predate the stripe-price-*-plan naming in stripe-billing.tf.
|
|
# Consumed by marketing-prod-* and accounts-prod-* Cloud Run services.
|
|
|
|
resource "google_secret_manager_secret" "stripe_price_professional" {
|
|
secret_id = "stripe-price-professional"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|
|
|
|
resource "google_secret_manager_secret" "stripe_price_founding" {
|
|
secret_id = "stripe-price-founding"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|
|
|
|
resource "google_secret_manager_secret" "stripe_price_family_child" {
|
|
secret_id = "stripe-price-family-child"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|
|
|
|
# ── CI infrastructure ─────────────────────────────────────────────────────────
|
|
|
|
resource "google_secret_manager_secret" "gitea_runner_token" {
|
|
secret_id = "gitea-runner-token"
|
|
project = var.project_id
|
|
|
|
replication {
|
|
auto {}
|
|
}
|
|
}
|