From bb291b1f01f2f14da0292681011bc5e4ac528cbc Mon Sep 17 00:00:00 2001
From: Ian Fijolek <ian@iamthefij.com>
Date: Tue, 13 Feb 2024 12:05:55 -0800
Subject: [PATCH] Move databases to their own tf files and improve first start

---
 databases/main.tf     | 62 -------------------------------------------
 databases/mysql.tf    | 41 ++++++++++++++++++++++++++++
 databases/postgres.tf | 41 ++++++++++++++++++++++++++++
 databases/redis.tf    | 12 +++++++++
 4 files changed, 94 insertions(+), 62 deletions(-)
 delete mode 100644 databases/main.tf
 create mode 100644 databases/mysql.tf
 create mode 100644 databases/postgres.tf
 create mode 100644 databases/redis.tf

diff --git a/databases/main.tf b/databases/main.tf
deleted file mode 100644
index 631ceb0..0000000
--- a/databases/main.tf
+++ /dev/null
@@ -1,62 +0,0 @@
-resource "nomad_job" "mysql-server" {
-  jobspec = file("${path.module}/mysql.nomad")
-
-  # Block until deployed as there are servics dependent on this one
-  detach = false
-}
-
-resource "nomad_acl_policy" "secrets_mysql" {
-  name        = "secrets-mysql"
-  description = "Give access to MySQL secrets"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "secrets/mysql/*" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-
-  job_acl {
-    job_id = resource.nomad_job.mysql-server.id
-  }
-}
-
-resource "nomad_job" "postgres-server" {
-  jobspec = file("${path.module}/postgres.nomad")
-
-  # Block until deployed as there are servics dependent on this one
-  detach = false
-}
-
-resource "nomad_acl_policy" "secrets_postgres" {
-  name        = "secrets-postgres"
-  description = "Give access to Postgres secrets"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "secrets/postgres/*" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-
-  job_acl {
-    job_id = resource.nomad_job.postgres-server.id
-  }
-}
-
-resource "nomad_job" "redis" {
-  for_each = toset(["blocky", "authelia"])
-
-  jobspec = templatefile("${path.module}/redis.nomad",
-    {
-      name = each.key,
-    }
-  )
-
-  # Block until deployed as there are servics dependent on this one
-  detach = false
-}
diff --git a/databases/mysql.tf b/databases/mysql.tf
new file mode 100644
index 0000000..1da5d49
--- /dev/null
+++ b/databases/mysql.tf
@@ -0,0 +1,41 @@
+resource "nomad_job" "mysql-server" {
+  jobspec = file("${path.module}/mysql.nomad")
+
+  # Block until deployed as there are servics dependent on this one
+  detach = false
+}
+
+resource "nomad_acl_policy" "secrets_mysql" {
+  name        = "secrets-mysql"
+  description = "Give access to MySQL secrets"
+  rules_hcl   = <<EOH
+namespace "default" {
+  variables {
+    path "secrets/mysql" {
+      capabilities = ["read"]
+    }
+    path "secrets/mysql/*" {
+      capabilities = ["read"]
+    }
+  }
+}
+EOH
+
+  job_acl {
+    # job_id = resource.nomad_job.mysql-server.id
+    job_id = "mysql-server"
+  }
+}
+
+# Create self-scoped psk so that config is valid at first start
+resource "random_password" "mysql_mysql_psk" {
+  length           = 32
+  override_special = "!@#%&*-_="
+}
+
+resource "nomad_variable" "mysql_mysql_psk" {
+  path = "secrets/mysql/allowed_psks/mysql"
+  items = {
+    psk = "mysql:${resource.random_password.mysql_mysql_psk.result}"
+  }
+}
diff --git a/databases/postgres.tf b/databases/postgres.tf
new file mode 100644
index 0000000..26d3603
--- /dev/null
+++ b/databases/postgres.tf
@@ -0,0 +1,41 @@
+resource "nomad_job" "postgres-server" {
+  jobspec = file("${path.module}/postgres.nomad")
+
+  # Block until deployed as there are servics dependent on this one
+  detach = false
+}
+
+resource "nomad_acl_policy" "secrets_postgres" {
+  name        = "secrets-postgres"
+  description = "Give access to Postgres secrets"
+  rules_hcl   = <<EOH
+namespace "default" {
+  variables {
+    path "secrets/postgres" {
+      capabilities = ["read"]
+    }
+    path "secrets/postgres/*" {
+      capabilities = ["read"]
+    }
+  }
+}
+EOH
+
+  job_acl {
+    # job_id = resource.nomad_job.postgres-server.id
+    job_id = "postgres-server"
+  }
+}
+
+# Create self-scoped psk so that config is valid at first start
+resource "random_password" "postgres_postgres_psk" {
+  length           = 32
+  override_special = "!@#%&*-_="
+}
+
+resource "nomad_variable" "postgres_postgres_psk" {
+  path = "secrets/postgres/allowed_psks/postgres"
+  items = {
+    psk = "postgres:${resource.random_password.postgres_postgres_psk.result}"
+  }
+}
diff --git a/databases/redis.tf b/databases/redis.tf
new file mode 100644
index 0000000..85515d6
--- /dev/null
+++ b/databases/redis.tf
@@ -0,0 +1,12 @@
+resource "nomad_job" "redis" {
+  for_each = toset(["blocky", "authelia"])
+
+  jobspec = templatefile("${path.module}/redis.nomad",
+    {
+      name = each.key,
+    }
+  )
+
+  # Block until deployed as there are servics dependent on this one
+  detach = false
+}