Wire Forge-native release infrastructure

infra/openbao/variables.tf

@@ -0,0 +1,137 @@
+variable "openbao_address" {
+  description = "OpenBao API address. The Vault provider reads the token from VAULT_TOKEN."
+  type        = string
+  default     = "https://vault.burrow.net"
+}
+
+variable "openbao_skip_tls_verify" {
+  description = "Skip TLS verification for local bootstrap only."
+  type        = bool
+  default     = false
+}
+
+variable "age_mount_path" {
+  description = "KV v2 mount path for migrated age-managed runtime secrets."
+  type        = string
+  default     = "age"
+}
+
+variable "manage_openbao_config" {
+  description = "Manage OpenBao mounts, policies, and Authentik OIDC auth. Requires VAULT_TOKEN."
+  type        = bool
+  default     = false
+}
+
+variable "authentik_issuer" {
+  description = "Authentik OpenBao OIDC issuer."
+  type        = string
+  default     = "https://auth.burrow.net/application/o/openbao/"
+}
+
+variable "authentik_client_id" {
+  description = "Public Authentik OpenBao OIDC client id."
+  type        = string
+  default     = "vault.burrow.net"
+}
+
+variable "authentik_admin_group" {
+  description = "Authentik group allowed to administer OpenBao."
+  type        = string
+  default     = "burrow-admins"
+}
+
+variable "authentik_runtime_group" {
+  description = "Authentik group allowed to read runtime secrets."
+  type        = string
+  default     = "burrow-automation"
+}
+
+variable "approle_auth_path" {
+  description = "OpenBao AppRole auth mount path for machine consumers."
+  type        = string
+  default     = "approle"
+}
+
+variable "runtime_approle_role_name" {
+  description = "AppRole role name used by Burrow runtime secret consumers."
+  type        = string
+  default     = "burrow-runtime"
+}
+
+variable "runtime_approle_token_ttl_seconds" {
+  description = "Token TTL for runtime AppRole login."
+  type        = number
+  default     = 3600
+}
+
+variable "runtime_approle_token_max_ttl_seconds" {
+  description = "Maximum token TTL for runtime AppRole login."
+  type        = number
+  default     = 7200
+}
+
+variable "runtime_approle_secret_id_ttl_seconds" {
+  description = "SecretID TTL for runtime AppRole. Zero means no expiry; rotate manually."
+  type        = number
+  default     = 0
+}
+
+variable "runtime_approle_secret_id_num_uses" {
+  description = "SecretID use limit for runtime AppRole. Zero means unlimited uses; rotate manually."
+  type        = number
+  default     = 0
+}
+
+variable "manage_google" {
+  description = "Manage Google Cloud KMS resources for OpenBao seal wrapping."
+  type        = bool
+  default     = false
+}
+
+variable "google_project_id" {
+  description = "Google Cloud project id for OpenBao seal wrapping."
+  type        = string
+  default     = "project-88c23ce9-918a-470a-b33"
+}
+
+variable "manage_google_kms_key_ring" {
+  description = "Create/manage the Google KMS key ring. Existing rings should be imported before enabling this."
+  type        = bool
+  default     = false
+}
+
+variable "google_kms_key_ring_name" {
+  description = "Google KMS key ring for OpenBao seal wrapping."
+  type        = string
+  default     = "burrow-identity"
+}
+
+variable "google_kms_key_ring_location" {
+  description = "Google KMS key ring location."
+  type        = string
+  default     = "global"
+}
+
+variable "google_kms_key_ring_id" {
+  description = "Existing Google KMS key ring id."
+  type        = string
+  default     = ""
+}
+
+variable "google_openbao_seal_key_name" {
+  description = "Google KMS symmetric key used for OpenBao seal wrapping."
+  type        = string
+  default     = "openbao-seal"
+}
+
+variable "google_openbao_seal_members" {
+  description = "IAM members allowed to encrypt/decrypt with the OpenBao seal key."
+  type        = set(string)
+  default     = []
+}
+
+variable "tags" {
+  description = "Additional labels applied to supported Google resources."
+  type        = map(string)
+  default     = {}
+}