atlas/tofu/secrets.tf

resource "vault_mount" "secret" {
  path        = "secret"
  type        = "kv-v2"
  description = "Primary KV v2 secrets store"
}

locals {
  pve_token_parts = split("=", var.proxmox_api_token)
}

resource "vault_kv_secret_v2" "proxmox_csi" {
  mount = vault_mount.secret.path
  name  = "proxmox-csi"
  data_json = jsonencode({
    token_id     = local.pve_token_parts[0]
    token_secret = local.pve_token_parts[1]
  })
}

resource "random_password" "postgres_password" {
  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "postgres" {
  mount = vault_mount.secret.path
  name  = "postgres"
  data_json = jsonencode({
    POSTGRES_PASSWORD = random_password.postgres_password.result
  })
}

resource "random_password" "sure_db_password" {
  length  = 32
  special = false
}

resource "random_password" "sure_secret_key_base" {
  length  = 64
  special = false
}

resource "vault_kv_secret_v2" "sure" {
  mount = vault_mount.secret.path
  name  = "sure"
  data_json = jsonencode({
    DB_PASSWORD     = random_password.sure_db_password.result
    SECRET_KEY_BASE = random_password.sure_secret_key_base.result
  })
}

resource "random_password" "authentik_secret_key" {
  length  = 50
  special = false
}

resource "random_password" "authentik_db_password" {
  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "authentik" {
  mount = vault_mount.secret.path
  name  = "authentik"
  data_json = jsonencode({
    secret_key          = random_password.authentik_secret_key.result
    postgresql_password = random_password.authentik_db_password.result
  })
}

resource "random_password" "immich_db_password" {
  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "immich" {
  mount = vault_mount.secret.path
  name  = "immich"
  data_json = jsonencode({
    DB_PASSWORD = random_password.immich_db_password.result
  })
}

resource "random_password" "paperless_db_password" {
  length  = 32
  special = false
}

resource "random_password" "paperless_secret_key" {
  length  = 64
  special = false
}

resource "vault_kv_secret_v2" "paperless" {
  mount = vault_mount.secret.path
  name  = "paperless"
  data_json = jsonencode({
    PAPERLESS_DBPASS     = random_password.paperless_db_password.result
    PAPERLESS_SECRET_KEY = random_password.paperless_secret_key.result
  })
}

resource "random_password" "netbox_db_password" {
  length  = 32
  special = false
}

resource "random_password" "netbox_secret_key" {
  length  = 50
  special = false
}

resource "vault_kv_secret_v2" "netbox" {
  mount = vault_mount.secret.path
  name  = "netbox"
  data_json = jsonencode({
    DB_PASSWORD = random_password.netbox_db_password.result
    SECRET_KEY  = random_password.netbox_secret_key.result
  })
}

resource "random_password" "printstash_db_password" {
  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "printstash" {
  mount = vault_mount.secret.path
  name  = "printstash"
  data_json = jsonencode({
    DB_PASSWORD = random_password.printstash_db_password.result
  })
}

resource "vault_kv_secret_v2" "vaultwarden" {
  mount = vault_mount.secret.path
  name  = "vaultwarden"
  data_json = jsonencode({
    ADMIN_TOKEN = var.vaultwarden_admin_token
  })
}

resource "random_password" "searxng_secret" {
  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "searxng" {
  mount = vault_mount.secret.path
  name  = "searxng"
  data_json = jsonencode({
    SEARXNG_SECRET = random_password.searxng_secret.result
  })
}

resource "random_password" "homebox_pepper" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "homebox" {
  mount = vault_mount.secret.path
  name  = "homebox"
  data_json = jsonencode({
    HBOX_AUTH_API_KEY_PEPPER = random_password.homebox_pepper.result
  })
}

resource "random_password" "invidious_db_password" {
  length  = 32
  special = false
}

resource "random_password" "invidious_hmac_key" {
  length  = 32
  special = false
}

resource "random_password" "invidious_companion_key" {
  length  = 16
  special = false
}

resource "vault_kv_secret_v2" "invidious" {
  mount = vault_mount.secret.path
  name  = "invidious"
  data_json = jsonencode({
    DB_PASSWORD   = random_password.invidious_db_password.result
    HMAC_KEY      = random_password.invidious_hmac_key.result
    COMPANION_KEY = random_password.invidious_companion_key.result
  })
}

resource "random_password" "karakeep_secret_key" {
  length  = 32
  special = false
}

resource "random_password" "karakeep_meili_key" {
  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "karakeep" {
  mount = vault_mount.secret.path
  name  = "karakeep"
  data_json = jsonencode({
    NEXTAUTH_SECRET  = random_password.karakeep_secret_key.result
    MEILI_MASTER_KEY = random_password.karakeep_meili_key.result
  })
}