📦 EqualifyEverything / equalify

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81locals {
  name = "${var.project_name}/${var.environment}"
}

# --- Generated secrets ------------------------------------------------------
# These are values the app only ever reads as plain env vars
# (`process.env.DB_PASSWORD`, etc.) — Terraform generates and stores them,
# no application code changes are required.

resource "random_password" "db_password" {
  length  = 32
  special = false # serverless-postgres / RDS connection strings choke on some special chars
}

resource "aws_secretsmanager_secret" "db_password" {
  name                    = "${local.name}/db-password"
  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "db_password" {
  secret_id     = aws_secretsmanager_secret.db_password.id
  secret_string = random_password.db_password.result
}

resource "random_password" "hasura_admin_secret" {
  length  = 32
  special = false
}

resource "aws_secretsmanager_secret" "hasura_admin_secret" {
  name                    = "${local.name}/hasura-admin-secret"
  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "hasura_admin_secret" {
  secret_id     = aws_secretsmanager_secret.hasura_admin_secret.id
  secret_string = random_password.hasura_admin_secret.result
}

resource "random_password" "webhook_secret" {
  length  = 32
  special = false
}

resource "aws_secretsmanager_secret" "webhook_secret" {
  name                    = "${local.name}/webhook-secret"
  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "webhook_secret" {
  secret_id     = aws_secretsmanager_secret.webhook_secret.id
  secret_string = random_password.webhook_secret.result
}

# --- SSO (Azure AD) config, optional ----------------------------------------
# Real tenant config must be supplied by the deployer post-apply; Terraform
# only reserves the Secrets Manager entry when sso_enabled is true.

resource "aws_secretsmanager_secret" "sso_config" {
  count = var.sso_enabled ? 1 : 0

  name                    = "${local.name}/sso-config"
  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "sso_config" {
  count = var.sso_enabled ? 1 : 0

  secret_id = aws_secretsmanager_secret.sso_config[0].id
  secret_string = jsonencode({
    SSO_JWKS          = "REPLACE_ME"
    SSO_CLIENT_ID     = "REPLACE_ME"
    SSO_TENANT        = "REPLACE_ME"
    SSO_EMAIL_DOMAINS = "[]"
  })

  lifecycle {
    ignore_changes = [secret_string]
  }
}