From 5289cab76e150a01961f1202244676e9d5897b99 Mon Sep 17 00:00:00 2001 From: "pierre.geeraert" Date: Thu, 8 Oct 2026 11:31:43 +0100 Subject: [PATCH] using env files but overcomplicated --- core/deployment.tf | 6 ++- core/env_files.tf | 49 +++++++++++++++++++ core/variables.auto.tfvars | 22 ++++++++- external_manifests/bitwarden/global.env | 12 +++++ .../bitwarden/global.override.env | 11 +++++ .../global.override.secret.env.example | 9 ++++ external_manifests/bitwarden/mssql.env | 2 + .../bitwarden/mssql.secret.env.example | 1 + external_manifests/bitwarden/uid.env | 2 + 9 files changed, 111 insertions(+), 3 deletions(-) create mode 100644 core/env_files.tf create mode 100644 external_manifests/bitwarden/global.env create mode 100644 external_manifests/bitwarden/global.override.env create mode 100644 external_manifests/bitwarden/global.override.secret.env.example create mode 100644 external_manifests/bitwarden/mssql.env create mode 100644 external_manifests/bitwarden/mssql.secret.env.example create mode 100644 external_manifests/bitwarden/uid.env diff --git a/core/deployment.tf b/core/deployment.tf index 9bb1bd9..930a3d1 100644 --- a/core/deployment.tf +++ b/core/deployment.tf @@ -235,7 +235,11 @@ resource "kubernetes_deployment_v1" "automatic" { } } } - depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc] + depends_on = [ + kubernetes_persistent_volume_claim_v1.automatic-pvc, + kubernetes_config_map_v1.env_file, + kubernetes_secret_v1.env_file, + ] } diff --git a/core/env_files.tf b/core/env_files.tf new file mode 100644 index 0000000..03f7528 --- /dev/null +++ b/core/env_files.tf @@ -0,0 +1,49 @@ +# Plain KEY=VALUE files (docker --env-file semantics, one pair per line, # comments) +# kept in external_manifests/, rendered into a ConfigMap or Secret at apply time. +# Deployments consume them through the existing config_map_ref / secret_ref fields. +variable "env_files" { + type = map(object({ + namespace = string + path = string # relative to this module, e.g. ../external_manifests/bitwarden/global.env + secret = optional(bool, false) + enabled = optional(bool, true) + })) + default = {} +} + +locals { + env_files = { for name, f in var.env_files : name => f if f.enabled } + + # A duplicate key inside one file fails the plan on purpose. + env_data = { + for name, f in local.env_files : name => { + for line in split("\n", replace(file("${path.module}/${f.path}"), "\r", "")) : + split("=", line)[0] => substr(line, length(split("=", line)[0]) + 1, -1) + if can(regex("^[A-Za-z_][^=\\s]*=", line)) + } + } +} + +resource "kubernetes_config_map_v1" "env_file" { + for_each = { for name, f in local.env_files : name => f if !f.secret } + metadata { + name = each.key + namespace = each.value.namespace + labels = { + deployment_method = "Terraform" + } + } + data = local.env_data[each.key] +} + +resource "kubernetes_secret_v1" "env_file" { + for_each = { for name, f in local.env_files : name => f if f.secret } + metadata { + name = each.key + namespace = each.value.namespace + labels = { + deployment_method = "Terraform" + } + } + data = local.env_data[each.key] +} diff --git a/core/variables.auto.tfvars b/core/variables.auto.tfvars index 6e16d3a..e7054d7 100644 --- a/core/variables.auto.tfvars +++ b/core/variables.auto.tfvars @@ -128,9 +128,9 @@ kubernetes = { replicas = 1 name = "bitwarden-admin" image = "ghcr.io/bitwarden/admin:2026.1.0" - extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"] service_port = [5000] config_map_ref = ["global.env", "uid.env", "global.override.env"] + secret_ref = ["global.override.secret"] environment = {} pvc = { @@ -168,6 +168,7 @@ kubernetes = { image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_api:2026.1.0" service_port = [5000] config_map_ref = ["global.env", "uid.env", "global.override.env"] + secret_ref = ["global.override.secret"] environment = {} pvc = { @@ -225,6 +226,7 @@ kubernetes = { image = "ghcr.io/bitwarden/events:2026.1.0" service_port = [5000] config_map_ref = ["global.env", "uid.env", "global.override.env"] + secret_ref = ["global.override.secret"] environment = {} pvc = { @@ -277,9 +279,11 @@ kubernetes = { connected_namespace = "bitwarden" replicas = 1 name = "bitwarden-identity" + extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"] image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_identity:2026.1.0" service_port = [5000] config_map_ref = ["global.env", "uid.env", "global.override.env"] + secret_ref = ["global.override.secret"] environment = {} pvc = { @@ -318,7 +322,8 @@ kubernetes = { name = "bitwarden-mssql" image = "ghcr.io/bitwarden/mssql:2026.1.0" service_port = [1433, 5000] - config_map_ref = ["mssql.env", "uid.env", "mssql.override.env"] + config_map_ref = ["mssql.env", "uid.env"] + secret_ref = ["mssql.secret"] environment = {} database = { shunt = "true" @@ -392,6 +397,7 @@ kubernetes = { image = "ghcr.io/bitwarden/notifications:2026.1.0" service_port = [5000] config_map_ref = ["global.env", "uid.env", "global.override.env"] + secret_ref = ["global.override.secret"] environment = {} pvc = { @@ -418,6 +424,7 @@ kubernetes = { image = "ghcr.io/bitwarden/sso:2026.1.0" service_port = [5000] config_map_ref = ["global.env", "uid.env", "global.override.env"] + secret_ref = ["global.override.secret"] environment = {} pvc = { @@ -469,3 +476,14 @@ kubernetes = { } } + +# Config kept as plain env files in external_manifests/, rendered into ConfigMaps/Secrets by env_files.tf. +# Reference them from a service with config_map_ref / secret_ref (names below). +env_files = { + "global.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.env" } + "global.override.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.env" } + "uid.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/uid.env" } + "mssql.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.env" } + "global.override.secret" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.secret.env", secret = true } + "mssql.secret" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.secret.env", secret = true } +} diff --git a/external_manifests/bitwarden/global.env b/external_manifests/bitwarden/global.env new file mode 100644 index 0000000..55b6318 --- /dev/null +++ b/external_manifests/bitwarden/global.env @@ -0,0 +1,12 @@ +ACCEPT_EULA=Y +ASPNETCORE_ENVIRONMENT=Production +globalSettings__baseServiceUri__vault=http://localhost +globalSettings__pushRelayBaseUri=https://push.bitwarden.com +globalSettings__selfHosted=true +globalSettings__baseServiceUri__internalNotifications=http://bitwarden-notifications-svc:5000 +globalSettings__baseServiceUri__internalAdmin=http://bitwarden-admin-svc:5000 +globalSettings__baseServiceUri__internalIdentity=http://bitwarden-identity-svc:5000 +globalSettings__baseServiceUri__internalApi=http://bitwarden-api-svc:5000 +globalSettings__baseServiceUri__internalVault=http://bitwarden-web-svc:5000 +globalSettings__baseServiceUri__internalSso=http://bitwarden-sso-svc:5000 +globalSettings__baseServiceUri__internalScim=http://bitwarden-self-host-scim:5000 diff --git a/external_manifests/bitwarden/global.override.env b/external_manifests/bitwarden/global.override.env new file mode 100644 index 0000000..cc85251 --- /dev/null +++ b/external_manifests/bitwarden/global.override.env @@ -0,0 +1,11 @@ +ACCEPT_EULA=Y +adminSettings__admins=pierre@geeraert.eu +globalSettings__baseServiceUri__vault=http://bitwarden.tryton.geeraert.eu +globalSettings__disableUserRegistration=false +globalSettings__installation__id=c36aded0-b0f1-4252-920b-ac4c008fc920 +globalSettings__mail__replyToEmail=no-reply@bitwarden.tryton.geeraert.eu +globalSettings__mail__smtp__host=smtp.gmail.com +globalSettings__mail__smtp__port=587 +globalSettings__mail__smtp__ssl=false +globalSettings__mail__smtp__username=p3jh6qa2@gmail.com +globalSettings__yubico__clientId=REPLACE diff --git a/external_manifests/bitwarden/global.override.secret.env.example b/external_manifests/bitwarden/global.override.secret.env.example new file mode 100644 index 0000000..d65dca7 --- /dev/null +++ b/external_manifests/bitwarden/global.override.secret.env.example @@ -0,0 +1,9 @@ +globalSettings__duo__aKey= +globalSettings__hibpApiKey= +globalSettings__identityServer__certificatePassword= +globalSettings__installation__key= +globalSettings__internalIdentityKey= +globalSettings__mail__smtp__password= +globalSettings__oidcIdentityClientKey= +globalSettings__sqlServer__connectionString= +globalSettings__yubico__key= diff --git a/external_manifests/bitwarden/mssql.env b/external_manifests/bitwarden/mssql.env new file mode 100644 index 0000000..6c35ff2 --- /dev/null +++ b/external_manifests/bitwarden/mssql.env @@ -0,0 +1,2 @@ +ACCEPT_EULA=Y +MSSQL_PID=Express diff --git a/external_manifests/bitwarden/mssql.secret.env.example b/external_manifests/bitwarden/mssql.secret.env.example new file mode 100644 index 0000000..00282e2 --- /dev/null +++ b/external_manifests/bitwarden/mssql.secret.env.example @@ -0,0 +1 @@ +SA_PASSWORD= diff --git a/external_manifests/bitwarden/uid.env b/external_manifests/bitwarden/uid.env new file mode 100644 index 0000000..9c065d2 --- /dev/null +++ b/external_manifests/bitwarden/uid.env @@ -0,0 +1,2 @@ +LOCAL_GID=1001 +LOCAL_UID=1001