# Terraform backends cannot contain interpolations terraform { backend "s3" { bucket = "dev-orcd-terraform-state" key = "dev/kafka-infra/akhq/terraform.tfstate" region = "us-east-1" encrypt = "true" } } data "aws_caller_identity" "current" {} module "default_tags" { source = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0" environment = var.environment application_family = var.application_family service_name = var.service_name } provider "aws" { region = var.aws_region default_tags { tags = module.default_tags.tags } } provider "aws" { region = var.aws_region alias = "dev" profile = "dev" default_tags { tags = module.default_tags.tags } } data "aws_route53_zone" "route53_zone" { name = "${var.environment}.theorchard.io" } module "akhq_fargate_environment" { source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.3.0" providers = { aws.dns = aws.dev } environment = var.environment service_name = var.service_name non_ecr_image = "086679231553.dkr.ecr.${var.aws_region}.amazonaws.com/${var.service_name}:latest" aws_region = var.aws_region application_family = var.application_family service_platform_version = "1.4.0" desired_task_count = 1 minimum_capacity = 1 maximum_capacity = 1 task_cpu = 1024 task_memory = 2048 container_port = 8080 health_check_grace_period_seconds = 120 health_check_path = "/ui" vpc_id = "vpc-34dbfd51" override_route53_zone_id = data.aws_route53_zone.route53_zone.zone_id https_listener_allow_prefix_list_names = [ "vpn-ny-users", ] environment_variables = [ { Environment = var.environment }, { JVM_OPTS = "-Xms128M -Xmx512M" }, { AKHQ_CONFIGURATION = <<-EOT akhq: connections: dev: properties: bootstrap.servers: "b-1.dev-managed-kafka-cdc.rk4es0.c11.kafka.us-east-1.amazonaws.com:9094,b-2.dev-managed-kafka-cdc.rk4es0.c11.kafka.us-east-1.amazonaws.com:9094,b-3.dev-managed-kafka-cdc.rk4es0.c11.kafka.us-east-1.amazonaws.com:9094" security.protocol: SSL schema-registry: url: "https://dev-schema-registry.dev.theorchard.io" type: confluent connect: - name: debezium-ats url: "https://dev-kafka-connect-debezium-ats.dev.theorchard.io" - name: es-sink url: "https://dev-kafka-connect-es-sink.dev.theorchard.io" - name: neo-sink-ats url: "https://dev-kafka-connect-neo-sink-ats.dev.theorchard.io" - name: sf-sink url: "https://dev-kafka-connect-sf-sink.dev.theorchard.io" - name: sf-sink-avro url: "https://dev-kafka-connect-sf-sink-avro.dev.theorchard.io" - name: sforce-sink url: "https://dev-kafka-connect-sforce-sink.dev.theorchard.io" ksqldb: - name: dev-ksqldb url: "https://dev-ksqldb-server.dev.theorchard.io:443" basic-auth-username: "akhq-test" basic-auth-password: "$${AKHQ_KSQL_PASSWORD}" useTls: true useAlpn: true artist_diy_dev: properties: bootstrap.servers: "b-1.dev-managed-kafka-arti.f45gcm.c7.kafka.us-east-1.amazonaws.com:9094,b-3.dev-managed-kafka-arti.f45gcm.c7.kafka.us-east-1.amazonaws.com:9094,b-2.dev-managed-kafka-arti.f45gcm.c7.kafka.us-east-1.amazonaws.com:9094" security.protocol: SSL security: roles: topic-read: - resources: [ "TOPIC", "TOPIC_DATA" ] actions: [ "READ" ] - resources: [ "TOPIC" ] actions: [ "READ_CONFIG" ] consumer-group-read: - resources: [ "CONSUMER_GROUP" ] actions: [ "READ" ] misc-read: - resources: [ "SCHEMA", "CONNECT_CLUSTER", "CONNECTOR", "NODE" ] actions: [ "READ" ] topic-admin: - resources: [ "TOPIC", "TOPIC_DATA" ] actions: [ "READ", "CREATE", "DELETE" ] - resources: [ "TOPIC" ] actions: [ "UPDATE", "READ_CONFIG", "ALTER_CONFIG" ] consumer-group-admin: - resources: [ "CONSUMER_GROUP" ] actions: [ "READ", "UPDATE_OFFSET", "DELETE_OFFSET" ] ksqldb-execute: - resources: [ "KSQLDB" ] actions: [ "EXECUTE", "READ"] ksqldb-read: - resources: [ "KSQLDB" ] actions: [ "READ" ] default-group: no-roles groups: power-users: - role: topic-admin - role: consumer-group-admin - role: misc-read - role: ksqldb-read - role: ksqldb-execute users: - role: topic-read - role: consumer-group-read - role: misc-read - role: ksqldb-execute basic-auth: - username: admin password: "$${AKHQ_ADMIN_PASSWORD_HASH}" groups: - admin oidc: enabled: true providers: azure: label: "Login with Azure" username-field: preferred_username default-group: power-users data-masking: filters: - description: "Masks email addresses" search-regex: '([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,6})' replacement: '[EMAIL MASKED]' - description: "Partially masks phone numbers" search-regex: '"([\+]?[(]?[0-9]{3}[)]?[-\s\.]?[0-9]{3}[-\s\.]?)[0-9]{4,6}"' replacement: '"$1xxxx"' - description: "Masks certain field in JSON docs" search-regex: '"dateOfBirth":".*"' replacement: '"dateOfBirth":"[DATE MASKED]"' micronaut: security: enabled: true oauth2: enabled: true callback-uri: "https://${var.environment}-${var.service_name}.dev.theorchard.io/oauth/callback{/provider}" clients: azure: client-id: "$${AKHQ_AZURE_CLIENT_ID}" client-secret: "$${AKHQ_AZURE_CLIENT_SECRET}" openid: issuer: "https://login.microsoftonline.com/f0aff3b7-91a5-4aae-af71-c63e1dda2049" endpoints: logout: get-allowed: true token: jwt: enabled: true cookie: enabled: true generator: access-token: expiration: 43200 signatures: secret: generator: secret: "$${AKHQ_JWT_SECRET}" EOT } ] secrets = [ { AKHQ_JWT_SECRET = "${var.environment}/${var.service_name}/AKHQ_JWT_SECRET" }, { AKHQ_ADMIN_PASSWORD_HASH = "${var.environment}/${var.service_name}/AKHQ_ADMIN_PASSWORD_HASH" }, { AKHQ_AZURE_CLIENT_ID = "${var.environment}/${var.service_name}/AKHQ_AZURE_CLIENT_ID" }, { AKHQ_AZURE_CLIENT_SECRET = "${var.environment}/${var.service_name}/AKHQ_AZURE_CLIENT_SECRET" }, { AKHQ_KSQL_PASSWORD = "${var.environment}/${var.service_name}/AKHQ_KSQL_PASSWORD" } ] } module "akhq_secrets" { source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1" for_each = toset(var.secrets_manager_secret_names) application_family = var.application_family environment = var.environment service_name = var.service_name secret_name = each.value }