feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

infrastructure/shared-postgresql/terraform/.terraform.lock.hcl

@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "4.8.0"
+  constraints = "~> 4.0"
+  hashes = [
+    "h1:aHqgWQhDBMeZO9iUKwJYMlh4q+xNMUlMIcjRbF4d02Y=",
+    "zh:269ab13433f67684012ae7e15876532b0312f5d0d2002a9cf9febb1279ce5ea6",
+    "zh:4babc95bf0c40eb85005db1dc2ca403c46be4a71dd3e409db3711a56f7a5ca0e",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:86e27c1c625ecc24446a11eeffc3ac319b36c2b4e51251db8579256a0dbcf136",
+    "zh:a32f31da94824009e26b077374440b52098aecb93c92ff55dc3d31dd37c4ea25",
+    "zh:be0a18c6c0425518bab4fbffd82078b82036a88503b5d76064de551c9f646cbf",
+    "zh:be5a77fdfd36863ebeec79cd12b1d13322ffad6821d157a0b279789fa06b5937",
+    "zh:be8317d142a3caad74c7d936039ae27076a1b2b8312ef5208e2871a5f525977c",
+    "zh:c94a84895a3d9954b80e983eed4603330a5cdbbd8eef5b3c99278c2d1402ef3c",
+    "zh:de1fb712784dd8415f011ca5346a34f87fab6046c730557615247e511dbc7d98",
+    "zh:e3eafae7da550f86cae395d6660b2a0e93ec8d2b0e0e5ef982ec762e961fc952",
+    "zh:ff35fb1ab6add288f0f368981e56f780b50405accd1937131cba1137999c8d83",
+  ]
+}

infrastructure/shared-postgresql/terraform/backend.tf

@@ -0,0 +1,15 @@
+# 与既有服务复用受限 tfstate 身份，使用独立对象与原生锁；不复用 Bao 的 state。
+terraform {
+  backend "s3" {
+    bucket                      = "tfstate"
+    key                         = "shared-postgresql/terraform.tfstate"
+    endpoints                   = { s3 = "https://s3.ad.ddupan.top" }
+    region                      = "us-east-1"
+    use_path_style              = true
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    use_lockfile                = true
+  }
+}

infrastructure/shared-postgresql/terraform/identity.tf

@@ -0,0 +1,35 @@
+# 复用现有 JWT-SVID 验证挂载，独立身份仅授权此服务所需路径。
+resource "vault_policy" "postgresql" {
+  name   = "homelab-postgresql-provisioner"
+  policy = <<-EOT
+    path "pki/sign/homelab-pg-prod" { capabilities = ["update"] }
+    path "pki/sign/homelab-pg-dev" { capabilities = ["update"] }
+    path "pki/sign/homelab-etcd-client" { capabilities = ["update"] }
+    path "kv/data/infra/postgresql/prod" { capabilities = ["create", "read", "update"] }
+    path "kv/data/infra/postgresql/dev" { capabilities = ["create", "read", "update"] }
+    path "kv/metadata/infra/postgresql/prod" { capabilities = ["read"] }
+    path "kv/metadata/infra/postgresql/dev" { capabilities = ["read"] }
+    path "kv/data/infra/etcd/consumers/patroni-pg-prod" { capabilities = ["read"] }
+    path "kv/data/infra/postgresql/ayatori/prod" { capabilities = ["create", "read", "update"] }
+    path "kv/data/infra/postgresql/ayatori/dev" { capabilities = ["create", "read", "update"] }
+    path "kv/metadata/infra/postgresql/ayatori/prod" { capabilities = ["read"] }
+    path "kv/metadata/infra/postgresql/ayatori/dev" { capabilities = ["read"] }
+    path "auth/token/lookup-self" { capabilities = ["read"] }
+    path "auth/token/revoke-self" { capabilities = ["update"] }
+  EOT
+}
+
+resource "vault_jwt_auth_backend_role" "postgresql" {
+  backend         = "jwt-spire"
+  role_name       = "homelab-postgresql"
+  role_type       = "jwt"
+  user_claim      = "sub"
+  bound_audiences = ["openbao"]
+  bound_claims = {
+    sub = "spiffe://ddupan.top/dev/panxiao81"
+  }
+  token_policies          = [vault_policy.postgresql.name]
+  token_no_default_policy = true
+  token_ttl               = 900
+  token_max_ttl           = 900
+}

infrastructure/shared-postgresql/terraform/main.tf

@@ -0,0 +1,30 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = { source = "hashicorp/vault", version = "~> 4.0" }
+  }
+}
+provider "vault" {
+  address = "https://bao.ad.ddupan.top:8200"
+  # 使用包装器取得的短期 token；它负责执行后撤销，不要求额外创建子 token。
+  skip_child_token = true
+}
+# 只管理新实例的签发角色；不保存 CA 私钥、实例密码或 etcd 账号。
+resource "vault_pki_secret_backend_role" "postgresql" {
+  for_each                    = toset(["prod", "dev"])
+  backend                     = "pki"
+  name                        = "homelab-pg-${each.key}"
+  allowed_domains             = ["pg-${each.key}.ad.ddupan.top"]
+  allow_bare_domains          = true
+  allow_subdomains            = false
+  allow_any_name              = false
+  allow_localhost             = false
+  allow_wildcard_certificates = false
+  allow_ip_sans               = true
+  server_flag                 = true
+  client_flag                 = false
+  key_type                    = "ec"
+  key_bits                    = 256
+  ttl                         = 5184000
+  max_ttl                     = 5184000
+}