feat: use a randomly generated password for the owner when empty (#5)

Signed-off-by: Yoan Blanc <yblanc@edgelab.ch>
Co-authored-by: Cyril Gaudin <cgaudin@edgelab.ch>
Co-authored-by: Vincent Thiery <vjmthiery@gmail.com>

Author: 3 people

README.md

@@ -19,17 +19,20 @@ In particular:
   - `${vault_backend_path}/${DB_NAME}_ro`, that obtains credentials for the `${DB_NAME}_ro` role;
   - `${vault_backend_path}/${DB_NAME}_rw`, that obtains credentials for the `${DB_NAME}_rw` role.
 
+- When the intent is to use Vault, it's recommended to **NOT** provide the `owner_password`. In this case, it's not possible to log directly with the owner username, but only with the credentials generated by Vault.
+
 
 ## Usage
 
 ```hcl
 module "foo" {
-  source = "git@github.com:edgelaboratories/terraform-postgresql-db?ref=v0.3.1"
+  source = "git@github.com:edgelaboratories/terraform-postgresql-db?ref=v0.4.0"
 
   database       = "foo"
-  owner          = "admin"
-  owner_password = "admin"
+  owner          = "admin"  # Optional, default to database name
+  owner_password = "admin"  # Optional when using Vault
 
+  # Optional
   vault_backend_path       = "postgresql/elmer"
   vault_db_connection_name = "elmer"
 }

database.tf

@@ -1,6 +1,6 @@
 resource "postgresql_role" "owner" {
-  name     = var.owner
-  login    = true
+  name     = coalesce(var.owner, var.database)
+  login    = var.owner_password != null ? true : false
   password = var.owner_password
   roles    = var.roles
 

variables.tf

@@ -15,11 +15,14 @@ variable "schemas" {
 }
 
 variable "owner" {
-  description = "The name of the owner of the database"
+  description = "The name of the owner of the database, defaults to database name"
+  default     = ""
 }
 
 variable "owner_password" {
   description = "The password for the owner of the database"
+  type        = string
+  default     = null
 }
 
 variable "roles" {

vault.tf

@@ -1,6 +1,6 @@
 locals {
   vault_roles = var.vault_backend_path == "" ? {} : {
-    "${postgresql_database.this.name}"    = postgresql_role.owner.name
+    "${postgresql_role.owner.name}"       = postgresql_role.owner.name
     "${postgresql_database.this.name}-ro" = postgresql_role.read_only.name
     "${postgresql_database.this.name}-rw" = postgresql_role.read_write.name
   }