a13labs.infra/terraform/k8sapps/buckets.tf

resource "random_string" "bucket_suffix" {
  length  = 8
  lower   = true
  upper   = false
  special = false
}

resource "scaleway_object_bucket" "backup" {
  name       = "a13labs-backup-${random_string.bucket_suffix.result}"
  project_id = var.scaleway_project_id
  region     = "fr-par"

  lifecycle_rule {
    id      = "gitea-clean"
    prefix  = "gitea-backup/"
    enabled = true

    expiration {
      days = local.cloud_backup_retention_days
    }
  }

  lifecycle_rule {
    id      = "wordpress-clean"
    prefix  = "wordpress-backup/"
    enabled = true

    expiration {
      days = local.cloud_backup_retention_days
    }
  }

  lifecycle_rule {
    id      = "nextcloud-clean"
    prefix  = "nextcloud-backup/"
    enabled = true

    expiration {
      days = local.cloud_backup_retention_days
    }
  }

  lifecycle_rule {
    id      = "mail-clean"
    prefix  = "mail-backup/"
    enabled = true

    expiration {
      days = local.cloud_backup_retention_days
    }
  }
}

resource "scaleway_object_bucket_policy" "backup" {
  bucket = scaleway_object_bucket.backup.name
  policy = jsonencode({
    Version = "2023-04-17",
    Id      = "AllowAccess",
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "user_id:${var.scaleway_user_id}"
        }
        Resource = [
          scaleway_object_bucket.backup.name,
          "${scaleway_object_bucket.backup.name}/*",
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "application_id:${scaleway_iam_application.backup_app.id}"
        }
        Resource = [
          scaleway_object_bucket.backup.name,
          "${scaleway_object_bucket.backup.name}/*",
        ]
      },
    ]
  })
}

resource "scaleway_object_bucket" "nextcloud" {
  name       = "a13labs-nextcloud-${random_string.bucket_suffix.result}"
  project_id = var.scaleway_project_id
  region     = "fr-par"
}

resource "scaleway_object_bucket_policy" "nextcloud" {
  bucket = scaleway_object_bucket.nextcloud.name
  policy = jsonencode({
    Version = "2023-04-17",
    Id      = "AllowAccess",
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "user_id:${var.scaleway_user_id}"
        }
        Resource = [
          scaleway_object_bucket.nextcloud.name,
          "${scaleway_object_bucket.nextcloud.name}/*",
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "application_id:${scaleway_iam_application.nextcloud_app.id}"
        }
        Resource = [
          scaleway_object_bucket.nextcloud.name,
          "${scaleway_object_bucket.nextcloud.name}/*",
        ]
      },
    ]
  })
}

resource "scaleway_object_bucket" "dovecot" {
  name       = "a13labs-dovecot-${random_string.bucket_suffix.result}"
  project_id = var.scaleway_project_id
  region     = "fr-par"
}

resource "scaleway_object_bucket_policy" "dovecot" {
  bucket = scaleway_object_bucket.dovecot.name
  policy = jsonencode({
    Version = "2023-04-17",
    Id      = "AllowAccess",
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "user_id:${var.scaleway_user_id}"
        }
        Resource = [
          scaleway_object_bucket.dovecot.name,
          "${scaleway_object_bucket.dovecot.name}/*",
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "application_id:${scaleway_iam_application.dovecot_app.id}"
        }
        Resource = [
          scaleway_object_bucket.dovecot.name,
          "${scaleway_object_bucket.dovecot.name}/*",
        ]
      },
    ]
  })
}

resource "scaleway_object_bucket" "sftpgo" {
  name       = "a13labs-sftpgo-${random_string.bucket_suffix.result}"
  project_id = var.scaleway_project_id
  region     = "fr-par"
}

resource "scaleway_object_bucket_policy" "sftpgo" {
  bucket = scaleway_object_bucket.sftpgo.name
  policy = jsonencode({
    Version = "2023-04-17",
    Id      = "AllowAccess",
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "user_id:${var.scaleway_user_id}"
        }
        Resource = [
          scaleway_object_bucket.sftpgo.name,
          "${scaleway_object_bucket.sftpgo.name}/*",
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "application_id:${scaleway_iam_application.sftpgo_app.id}"
        }
        Resource = [
          scaleway_object_bucket.sftpgo.name,
          "${scaleway_object_bucket.sftpgo.name}/*",
        ]
      },
    ]
  })
}