feat(gitea): refactor configuration to use structured app_config and add TLS support

terraform/modules/db/mariadb/main.tf

@@ -10,6 +10,37 @@ resource "kubernetes_secret" "root_password" {
   type = "Opaque"
 }
 
+resource "kubernetes_manifest" "internal_cert" {
+  count = var.tls_enabled ? 1 : 0
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "mariadb-cert"
+      namespace = var.namespace
+    }
+    spec = {
+      secretName = "mariadb-cert"
+      issuerRef = {
+        name = var.issuer
+        kind = "ClusterIssuer"
+      }
+      commonName = "${var.app_name}-db-cert"
+    }
+  }
+}
+
+resource "kubernetes_config_map" "ssl_config" {
+  count = var.tls_enabled ? 1 : 0
+  metadata {
+    name      = "${var.app_name}-mariadb-config"
+    namespace = var.namespace
+  }
+  data = {
+    "tls.cnf" = file("${path.module}/resources/tls.cnf")
+  }
+}
+
 resource "kubernetes_service_account" "service_account" {
 
   metadata {
@@ -94,7 +125,7 @@ resource "kubernetes_deployment" "deployment" {
             exec {
               command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"]
             }
-            initial_delay_seconds = 120
+            initial_delay_seconds = 30
             period_seconds        = 10
             timeout_seconds       = 1
             failure_threshold     = 15
@@ -147,6 +178,23 @@ resource "kubernetes_deployment" "deployment" {
             mount_path = "/docker-entrypoint-initdb.d"
             name       = "initdb-storage"
           }
+          dynamic "volume_mount" {
+            for_each = var.tls_enabled ? [1] : []
+            content {
+              mount_path = "/etc/ssl/certs/private"
+              name       = "mariadb-cert"
+              read_only  = true
+            }
+          }
+          dynamic "volume_mount" {
+            for_each = var.tls_enabled ? [1] : []
+            content {
+              mount_path = "/etc/mysql/conf.d/tls.cnf"
+              name       = "ssl-config"
+              sub_path   = "tls.cnf"
+              read_only  = true
+            }
+          }
         }
         volume {
           name = "persistent-storage"
@@ -160,6 +208,32 @@ resource "kubernetes_deployment" "deployment" {
             path = "${var.database_folder}/${var.app_name}.initdb.d"
           }
         }
+        dynamic "volume" {
+          for_each = var.tls_enabled ? [1] : []
+          content {
+            name = "mariadb-cert"
+            secret {
+              secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"]
+              items {
+                key  = "tls.crt"
+                path = "tls.crt"
+              }
+              items {
+                key  = "tls.key"
+                path = "tls.key"
+              }
+            }
+          }
+        }
+        dynamic "volume" {
+          for_each = var.tls_enabled ? [1] : []
+          content {
+            name = "ssl-config"
+            config_map {
+              name = kubernetes_config_map.ssl_config[0].metadata[0].name
+            }
+          }
+        }
       }
     }
   }

terraform/modules/db/mariadb/resources/tls.cnf

@@ -0,0 +1,4 @@
+[mysqld]
+ssl-cert = /etc/ssl/certs/private/tls.crt
+ssl-key = /etc/ssl/certs/private/tls.key
+tls-version = TLSv1.2,TLSv1.3

terraform/modules/db/mariadb/variables.tf

@@ -49,3 +49,15 @@ variable "backup_folder" {
   description = "Backup source location"
   type        = string
 }
+
+variable "tls_enabled" {
+  description = "Enable SSL for MariaDB"
+  default     = false
+  type        = bool
+}
+
+variable "issuer" {
+  description = "Issuer for SSL certificate"
+  default     = "internal-ca"
+  type        = string
+}