Add infrastructure bucket for storing assets

.github/workflows/ansible-apply.yaml

@@ -80,9 +80,10 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           cd ansible
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml --skip-tags roles::cis::suid
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_m3uproxy.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml

.github/workflows/terraform-iac-apply.yaml

@@ -0,0 +1,39 @@
+name: Terraform Apply
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "terraform/iac/**"
+      - .github/workflows/terraform-iac-apply.yaml
+
+jobs:
+  terraform-apply:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.9.6
+
+      - name: Setup Sectool
+        uses: a13labs/setup-sectool@v1
+
+      - name: Terraform Init
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform init
+
+      - name: Terraform Apply
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform apply --auto-approve

.github/workflows/terraform-iac-validate.yaml

@@ -0,0 +1,47 @@
+name: Terraform Validate
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "terraform/iac/**"
+      - .github/workflows/terraform-iac-validate.yaml
+    types:
+      - opened
+      - synchronize
+      - reopened
+jobs:
+  terraform-validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.9.6
+
+      - name: Setup Sectool
+        uses: a13labs/setup-sectool@v1
+
+      - name: Terraform Init
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform init
+
+      - name: Terraform Plan
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec -n terraform plan -out=tfplan
+
+      - name: Show Terraform Plan
+        run: |
+          cd terraform/iac
+          terraform show tfplan