Add Scaleway IAC configuration with OpenTofu integration and environment setup

terraform/scaleway-iac/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "a13labs.infra.eu"
+    key    = "scaleway.core.infra.tfstate"
+    region = "eu-west-1"
+  }
+}

terraform/scaleway-iac/buckets.tf

@@ -0,0 +1,45 @@
+resource "scaleway_object_bucket" "infra_assets" {
+  name       = "a13labs-infra-${var.bucket_suffix}"
+  project_id = var.scaleway_project_id
+  region     = "fr-par"
+}
+
+resource "scaleway_object_bucket_policy" "policy" {
+  bucket = scaleway_object_bucket.infra_assets.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowMachineDownload",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:ListBucket",
+          "s3:GetObject",
+        ]
+        Principal = "*"
+        Resource = [
+          scaleway_object_bucket.infra_assets.name,
+          "${scaleway_object_bucket.infra_assets.name}/*",
+        ]
+        Condition = {
+          IpAddress = {
+            "aws:SourceIp" = local.instance_ips
+          }
+        },
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.infra_assets.name,
+          "${scaleway_object_bucket.infra_assets.name}/*",
+        ]
+      },
+    ]
+  })
+}

terraform/scaleway-iac/config.tf

@@ -0,0 +1,21 @@
+locals {
+  instance_ips = [
+    "${local.vps_1.ip}/32",
+  ]
+
+  vps_1 = {
+    id   = data.terraform_remote_state.contabo.outputs.instances[0].id
+    name = data.terraform_remote_state.contabo.outputs.instances[0].name
+    ip   = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip
+  }
+}
+
+data "terraform_remote_state" "contabo" {
+  backend = "s3"
+  config = {
+    bucket = "a13labs.infra.eu"
+    key    = "contabo.core.infra.tfstate"
+    region = "eu-west-1"
+  }
+}
+

terraform/scaleway-iac/encryption.tf

@@ -0,0 +1,6 @@
+resource "scaleway_object" "system_id_encryption_key" {
+  bucket = scaleway_object_bucket.infra_assets.id
+  key    = "keys/${var.system_id}"
+
+  content_base64 = base64encode(var.encryption_key)
+}

terraform/scaleway-iac/import.tf

@@ -0,0 +1,20 @@
+import {
+  to = scaleway_object.system_id_encryption_key
+  id = "fr-par/a13labs-infra-${nonsensitive(var.bucket_suffix)}/keys/${nonsensitive(var.system_id)}"
+}
+
+import {
+  to = scaleway_registry_namespace.a13labs
+  id = "fr-par/ea39fede-ad83-4616-aa53-529cf5d01b16"
+}
+
+import {
+  to = scaleway_object_bucket.infra_assets
+  id = "fr-par/a13labs-infra-${nonsensitive(var.bucket_suffix)}"
+}
+
+import {
+  to = scaleway_object_bucket_policy.policy
+  id = "fr-par/a13labs-infra-${nonsensitive(var.bucket_suffix)}"
+}
+

terraform/scaleway-iac/provider.tf

@@ -0,0 +1,19 @@
+
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    scaleway = {
+      source  = "scaleway/scaleway"
+      version = "~>2.13"
+    }
+  }
+}
+
+provider "scaleway" {
+  zone            = "fr-par-2"
+  region          = "fr-par"
+  access_key      = var.scaleway_access_key
+  secret_key      = var.scaleway_secret_key
+  organization_id = var.scaleway_organization_id
+}
+

terraform/scaleway-iac/registry.tf

@@ -0,0 +1,5 @@
+resource "scaleway_registry_namespace" "a13labs" {
+  name        = "a13labs"
+  description = "A13Labs container registry"
+  is_public   = false
+}

terraform/scaleway-iac/sectool.env

@@ -0,0 +1,9 @@
+AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY
+AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY
+TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY
+TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY
+TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
+TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID
+TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID
+TF_VAR_bucket_suffix=$BUCKET_SUFFIX
+TF_VAR_encryption_key=$ENCRYPT_KEY

terraform/scaleway-iac/variables.tf

@@ -0,0 +1,47 @@
+variable "scaleway_access_key" {
+  description = "Scaleway Access key"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_secret_key" {
+  description = "Scaleway Secret key"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_project_id" {
+  description = "Scaleway Project Id"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_organization_id" {
+  description = "Scaleway Organization Id"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_user_id" {
+  description = "Scaleway User Id"
+  type        = string
+  sensitive   = true
+}
+
+variable "encryption_key" {
+  description = "Encryption key for sensitive data"
+  type        = string
+  sensitive   = true
+}
+
+variable "bucket_suffix" {
+  description = "Suffix for bucket names"
+  type        = string
+  sensitive   = true
+}
+
+variable "system_id" {
+  description = "System ID"
+  type        = string
+  sensitive   = true
+}