51 lines
1.9 KiB
HCL
51 lines
1.9 KiB
HCL
// OVHcloud Managed PostgreSQL. The cloud provider credentials and the
|
|
// project (OVH_CLOUD_PROJECT_SERVICE) reach the provider from the runner
|
|
// environment, never from module inputs.
|
|
|
|
resource "ovh_cloud_project_database" "this" {
|
|
service_name = var.project_id
|
|
description = "${var.name_prefix}-postgresql-${var.deployment_id}"
|
|
engine = "postgresql"
|
|
version = var.engine_version
|
|
plan = var.plan
|
|
flavor = var.flavor
|
|
|
|
nodes {
|
|
region = var.region
|
|
network_id = var.private_network_id
|
|
subnet_id = var.private_subnet_id
|
|
}
|
|
|
|
dynamic "ip_restrictions" {
|
|
for_each = var.allowed_ips
|
|
content {
|
|
ip = ip_restrictions.value
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "ovh_cloud_project_database_database" "this" {
|
|
service_name = ovh_cloud_project_database.this.service_name
|
|
engine = ovh_cloud_project_database.this.engine
|
|
cluster_id = ovh_cloud_project_database.this.id
|
|
name = var.database_name
|
|
}
|
|
|
|
// The user password is ALWAYS generated server side by OVHcloud, it cannot
|
|
// be set to an arbitrary value: it is read from the computed .password
|
|
// attribute and delivered only through the Vault entry. password_reset is
|
|
// the provider's native rotation marker: any change to credentials_version
|
|
// makes OVHcloud regenerate the password in place, and the Vault entry is
|
|
// updated with the fresh credential in the same apply.
|
|
resource "ovh_cloud_project_database_postgresql_user" "this" {
|
|
service_name = ovh_cloud_project_database.this.service_name
|
|
cluster_id = ovh_cloud_project_database.this.id
|
|
name = var.username
|
|
password_reset = var.credentials_version
|
|
|
|
// Serialize operations against the cluster: OVH DBaaS processes one
|
|
// operation at a time per cluster, and concurrent destroys (user +
|
|
// database in parallel) intermittently fail with API 500s.
|
|
depends_on = [ovh_cloud_project_database_database.this]
|
|
}
|