feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

2026-09-25 19:34:48 +00:00
parent acd4b55722
commit 3a2fe5fa0c
92 changed files with 4211 additions and 0 deletions
@@ -0,0 +1,30 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = { source = "hashicorp/vault", version = "~> 4.0" }
+  }
+}
+provider "vault" {
+  address = "https://bao.ad.ddupan.top:8200"
+  # 使用包装器取得的短期 token；它负责执行后撤销，不要求额外创建子 token。
+  skip_child_token = true
+}
+# 只管理新实例的签发角色；不保存 CA 私钥、实例密码或 etcd 账号。
+resource "vault_pki_secret_backend_role" "postgresql" {
+  for_each                    = toset(["prod", "dev"])
+  backend                     = "pki"
+  name                        = "homelab-pg-${each.key}"
+  allowed_domains             = ["pg-${each.key}.ad.ddupan.top"]
+  allow_bare_domains          = true
+  allow_subdomains            = false
+  allow_any_name              = false
+  allow_localhost             = false
+  allow_wildcard_certificates = false
+  allow_ip_sans               = true
+  server_flag                 = true
+  client_flag                 = false
+  key_type                    = "ec"
+  key_bits                    = 256
+  ttl                         = 5184000
+  max_ttl                     = 5184000
+}