using env files but overcomplicated

core/deployment.tf

@@ -235,7 +235,11 @@ resource "kubernetes_deployment_v1" "automatic" {
       }
     }
   }
-  depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
+  depends_on = [
+    kubernetes_persistent_volume_claim_v1.automatic-pvc,
+    kubernetes_config_map_v1.env_file,
+    kubernetes_secret_v1.env_file,
+  ]
 }
 
 

core/env_files.tf

@@ -0,0 +1,49 @@
+# Plain KEY=VALUE files (docker --env-file semantics, one pair per line, # comments)
+# kept in external_manifests/, rendered into a ConfigMap or Secret at apply time.
+# Deployments consume them through the existing config_map_ref / secret_ref fields.
+variable "env_files" {
+  type = map(object({
+    namespace = string
+    path      = string # relative to this module, e.g. ../external_manifests/bitwarden/global.env
+    secret    = optional(bool, false)
+    enabled   = optional(bool, true)
+  }))
+  default = {}
+}
+
+locals {
+  env_files = { for name, f in var.env_files : name => f if f.enabled }
+
+  # A duplicate key inside one file fails the plan on purpose.
+  env_data = {
+    for name, f in local.env_files : name => {
+      for line in split("\n", replace(file("${path.module}/${f.path}"), "\r", "")) :
+      split("=", line)[0] => substr(line, length(split("=", line)[0]) + 1, -1)
+      if can(regex("^[A-Za-z_][^=\\s]*=", line))
+    }
+  }
+}
+
+resource "kubernetes_config_map_v1" "env_file" {
+  for_each = { for name, f in local.env_files : name => f if !f.secret }
+  metadata {
+    name      = each.key
+    namespace = each.value.namespace
+    labels = {
+      deployment_method = "Terraform"
+    }
+  }
+  data = local.env_data[each.key]
+}
+
+resource "kubernetes_secret_v1" "env_file" {
+  for_each = { for name, f in local.env_files : name => f if f.secret }
+  metadata {
+    name      = each.key
+    namespace = each.value.namespace
+    labels = {
+      deployment_method = "Terraform"
+    }
+  }
+  data = local.env_data[each.key]
+}

core/variables.auto.tfvars

@@ -128,9 +128,9 @@ kubernetes = {
     replicas       = 1
     name           = "bitwarden-admin"
     image          = "ghcr.io/bitwarden/admin:2026.1.0"
-    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
     service_port   = [5000]
     config_map_ref = ["global.env", "uid.env", "global.override.env"]
+    secret_ref     = ["global.override.secret"]
     environment    = {}
 
     pvc = {
@@ -168,6 +168,7 @@ kubernetes = {
     image               = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_api:2026.1.0"
     service_port        = [5000]
     config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    secret_ref          = ["global.override.secret"]
     environment         = {}
 
     pvc = {
@@ -225,6 +226,7 @@ kubernetes = {
     image               = "ghcr.io/bitwarden/events:2026.1.0"
     service_port        = [5000]
     config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    secret_ref          = ["global.override.secret"]
     environment         = {}
 
     pvc = {
@@ -277,9 +279,11 @@ kubernetes = {
     connected_namespace = "bitwarden"
     replicas            = 1
     name                = "bitwarden-identity"
+    extra_manifest      = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
     image               = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_identity:2026.1.0"
     service_port        = [5000]
     config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    secret_ref          = ["global.override.secret"]
     environment         = {}
 
     pvc = {
@@ -318,7 +322,8 @@ kubernetes = {
     name                = "bitwarden-mssql"
     image               = "ghcr.io/bitwarden/mssql:2026.1.0"
     service_port        = [1433, 5000]
-    config_map_ref      = ["mssql.env", "uid.env", "mssql.override.env"]
+    config_map_ref      = ["mssql.env", "uid.env"]
+    secret_ref          = ["mssql.secret"]
     environment         = {}
     database = {
       shunt    = "true"
@@ -392,6 +397,7 @@ kubernetes = {
     image               = "ghcr.io/bitwarden/notifications:2026.1.0"
     service_port        = [5000]
     config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    secret_ref          = ["global.override.secret"]
     environment         = {}
 
     pvc = {
@@ -418,6 +424,7 @@ kubernetes = {
     image               = "ghcr.io/bitwarden/sso:2026.1.0"
     service_port        = [5000]
     config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    secret_ref          = ["global.override.secret"]
     environment         = {}
 
     pvc = {
@@ -469,3 +476,14 @@ kubernetes = {
   }
 
 }
+
+# Config kept as plain env files in external_manifests/, rendered into ConfigMaps/Secrets by env_files.tf.
+# Reference them from a service with config_map_ref / secret_ref (names below).
+env_files = {
+  "global.env"             = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.env" }
+  "global.override.env"    = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.env" }
+  "uid.env"                = { namespace = "bitwarden", path = "../external_manifests/bitwarden/uid.env" }
+  "mssql.env"              = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.env" }
+  "global.override.secret" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.secret.env", secret = true }
+  "mssql.secret"           = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.secret.env", secret = true }
+}

external_manifests/bitwarden/global.env

@@ -0,0 +1,12 @@
+ACCEPT_EULA=Y
+ASPNETCORE_ENVIRONMENT=Production
+globalSettings__baseServiceUri__vault=http://localhost
+globalSettings__pushRelayBaseUri=https://push.bitwarden.com
+globalSettings__selfHosted=true
+globalSettings__baseServiceUri__internalNotifications=http://bitwarden-notifications-svc:5000
+globalSettings__baseServiceUri__internalAdmin=http://bitwarden-admin-svc:5000
+globalSettings__baseServiceUri__internalIdentity=http://bitwarden-identity-svc:5000
+globalSettings__baseServiceUri__internalApi=http://bitwarden-api-svc:5000
+globalSettings__baseServiceUri__internalVault=http://bitwarden-web-svc:5000
+globalSettings__baseServiceUri__internalSso=http://bitwarden-sso-svc:5000
+globalSettings__baseServiceUri__internalScim=http://bitwarden-self-host-scim:5000

external_manifests/bitwarden/global.override.env

@@ -0,0 +1,11 @@
+ACCEPT_EULA=Y
+adminSettings__admins=pierre@geeraert.eu
+globalSettings__baseServiceUri__vault=http://bitwarden.tryton.geeraert.eu
+globalSettings__disableUserRegistration=false
+globalSettings__installation__id=c36aded0-b0f1-4252-920b-ac4c008fc920
+globalSettings__mail__replyToEmail=no-reply@bitwarden.tryton.geeraert.eu
+globalSettings__mail__smtp__host=smtp.gmail.com
+globalSettings__mail__smtp__port=587
+globalSettings__mail__smtp__ssl=false
+globalSettings__mail__smtp__username=p3jh6qa2@gmail.com
+globalSettings__yubico__clientId=REPLACE

external_manifests/bitwarden/global.override.secret.env.example

@@ -0,0 +1,9 @@
+globalSettings__duo__aKey=
+globalSettings__hibpApiKey=
+globalSettings__identityServer__certificatePassword=
+globalSettings__installation__key=
+globalSettings__internalIdentityKey=
+globalSettings__mail__smtp__password=
+globalSettings__oidcIdentityClientKey=
+globalSettings__sqlServer__connectionString=
+globalSettings__yubico__key=

external_manifests/bitwarden/mssql.env

@@ -0,0 +1,2 @@
+ACCEPT_EULA=Y
+MSSQL_PID=Express

external_manifests/bitwarden/mssql.secret.env.example

@@ -0,0 +1 @@
+SA_PASSWORD=

external_manifests/bitwarden/uid.env

@@ -0,0 +1,2 @@
+LOCAL_GID=1001
+LOCAL_UID=1001