homebrew-user-management

User management for the Homebrew organisation using OpenTofu

Requirements

• This project uses OpenTofu, not Terraform

Usage

• Set GITHUB_TOKEN to a token with sufficient permissions before usage.
• Use aws configure sso to log into the Homebrew AWS org.
• Set AWS_PROFILE to the resulting profile.
• tofu init
• tofu plan -var-file .tfvars

Secrets

CI requires the following secrets:

• amazon_role: The ARN of the AWS role to use for OIDC auth.
• email_overrides: Map of GitHub usernames with emails for people who want a different email for tools from their GH email
• TF_GH_TOKEN: GitHub token with permissions to manage org teams, users and repo permissions
• TF_DNSIMPLE_ACCOUNT: Account ID for DNSimple
• TF_DNSIMPLE_TOKEN: Token to authenticate to DNSimple

TODO

• Google workspace management for brew.sh
• Google Cloud manangement for self-hosted workers
• Add DNSSimple