From f5e36aaec349f14b799d6bc8101bd24da69bbcb7 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Sun, 31 Dec 2023 18:47:26 +0200
Subject: retrieve fluxdb password from AWS secrets manager.

---
 org-buetow-ecs/fluxpostgreservice.tf | 10 +++++++++-
 org-buetow-ecs/fluxservice.tf        |  2 +-
 org-buetow-ecs/variables.tf          |  5 ++---
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/org-buetow-ecs/fluxpostgreservice.tf b/org-buetow-ecs/fluxpostgreservice.tf
index 8434b91..5007940 100644
--- a/org-buetow-ecs/fluxpostgreservice.tf
+++ b/org-buetow-ecs/fluxpostgreservice.tf
@@ -81,7 +81,7 @@ resource "aws_ecs_task_definition" "fluxpostgres" {
       },
       {
         name  = "POSTGRES_PASSWORD",
-        value = var.fluxdb_password,
+        value = data.aws_secretsmanager_secret_version.fluxdb_password.secret_string
       }
     ],
     mountPoints = [
@@ -168,3 +168,11 @@ resource "aws_ecs_service" "fluxpostgres" {
     assign_public_ip = false
   }
 }
+
+data "aws_secretsmanager_secret" "fluxdb_password" {
+  name = "fluxdb_password"
+}
+
+data "aws_secretsmanager_secret_version" "fluxdb_password" {
+  secret_id = data.aws_secretsmanager_secret.fluxdb_password.id
+}
diff --git a/org-buetow-ecs/fluxservice.tf b/org-buetow-ecs/fluxservice.tf
index 0a8ffcf..358060a 100644
--- a/org-buetow-ecs/fluxservice.tf
+++ b/org-buetow-ecs/fluxservice.tf
@@ -48,7 +48,7 @@ resource "aws_ecs_task_definition" "flux" {
     environment = [
       {
         name  = "DATABASE_URL",
-        value = "postgres://miniflux:${var.fluxdb_password}@${aws_lb.fluxpostgres_nlb.dns_name}/miniflux?sslmode=disable",
+        value = "postgres://miniflux:${data.aws_secretsmanager_secret_version.fluxdb_password.secret_string}@${aws_lb.fluxpostgres_nlb.dns_name}/miniflux?sslmode=disable",
       },
       {
         name  = "RUN_MIGRATIONS",
diff --git a/org-buetow-ecs/variables.tf b/org-buetow-ecs/variables.tf
index f7bec73..139597f 100644
--- a/org-buetow-ecs/variables.tf
+++ b/org-buetow-ecs/variables.tf
@@ -1,3 +1,2 @@
-variable "fluxdb_password" {
-  type = string
-}
+
+
-- 
cgit v1.2.3