moritz/infrapuzzle
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(openclaw): integrate YouTube and Google Maps Platform MCP skills and GCP infrastructure

Browse Source
This commit is contained in:
Moritz Graf
2026-09-18 11:46:10 +02:00
parent bdfd5f5057
commit 474af29c4d
9 changed files with 609 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+2
View File
@@ -62,6 +62,8 @@ This repository is divided into distinct domains, each with its own `AGENTS.md`
* **Consulting ADRs**: AI agents MUST consult `docs/adr/` before designing or altering system architecture, agent topologies, or tool integration patterns.
* **Key Records**:
* [ADR 0001: Hybrid MCP Tool Search and Subagent Delegation for AI Agents](docs/adr/0001-hybrid-mcp-tool-search-and-subagents.md)
* [ADR 0002: OpenClaw Multi-Tier Model Selection, Latency Optimization, and Inference Economics](docs/adr/0002-openclaw-model-selection-tiering-and-economics.md)
* [ADR 0003: Everything as Code (EaC) and Reproducible Declarative Infrastructure](docs/adr/0003-everything-as-code-and-reproducible-infrastructure.md)
## Global Constraints
* **Secrets**: `git-crypt` is used extensively. Ensure you have the unlock key before editing `*.secret` files.
docs/adr/0003-everything-as-code-and-reproducible-infrastructure.md
+153
View File
@@ -0,0 +1,153 @@
---
status: "accepted"
date: 2026-09-17
decision-makers: ["Moritz Graf", "Antigravity"]
consulted: []
informed: []
---
# ADR 0003: Everything as Code (EaC) and Reproducible Declarative Infrastructure
## Context and Problem Statement
The **Infrapuzzle** monorepo governs the complete digital infrastructure for Moritz Graf and family: bare-metal server provisioning (Haumdaucher node), Kubernetes workloads, DNS management, mail routing, smart home/IoT edge devices, and AI concierge workflows (OpenClaw and specialized domain subagents).
Historically, home labs and personal infrastructure suffer from the "snowflake" problem:
1. **Undocumented ClickOps**: Settings altered manually in cloud provider consoles (e.g. OVH DNS, router web UIs) or via web dashboards (Home Assistant, Grafana) become unversioned, undocumented, and fragile.
2. **Ephemeral Terminal Interventions**: Ad-hoc `kubectl edit`, hot-patched container environments, or manual secret injections deviate from repository state, rendering disaster recovery nearly impossible.
3. **Agent Prompt Fragmentation**: As AI agents proliferate (e.g. OpenClaw conductor, domain subagents like Hebamme, Koch, Grabengasse, Fitness, Recherche), defining prompts or tool configs across disparate Helm values, ConfigMaps, and local files leads to inconsistencies, stale behavior, and duplicate definitions.
How do we establish a strict, maintainable architectural standard that ensures **everything is defined as code as far as feasible and reproducible**, while accommodating dynamic runtime state and secrets safely?
---
## Decision Drivers
* **Determinism & Disaster Recovery**: The entire single-node cluster (`haumdaucher.de`), along with all services, DNS records, and edge devices, must be rebuildable from scratch purely from git repositories.
* **Single Source of Truth**: Eliminate configuration drift across all operational domains.
* **Exclusive Agent Storage**: Establish an unambiguous, single home for all AI agent personas, system prompts, role boundaries, and tool guidance.
* **Declarative Secret Management**: Store all secrets in version control without risking plain-text credential leaks.
* **Pragmatic Feasibility Boundary**: Clearly separate declarative desired state (in Git) from legitimate mutable runtime data (databases, dynamic chat histories, live OAuth session tokens) without breaking stateful applications.
---
## Considered Options
1. **Option 1: Ad-Hoc / Best-Effort Setup (Status Quo Antipattern)**
* Store major K8s manifests in git, but allow manual tweaks in web consoles (OVH, Home Assistant, Shelly) and ad-hoc `kubectl` patches.
* *Drawbacks*: Severe drift, snowflake server syndrome, impossible disaster recovery, zero audit trail.
2. **Option 2: Pure GitOps Immutability with Zero Runtime Mutation**
* Force every state mutation (including session compacting, OAuth token refreshes, and dynamic settings) to generate a Git commit.
* *Drawbacks*: Impractical for stateful workloads. High friction, commit noise, rate limits on git providers, and potential race conditions when multi-agent systems rapidly update local session caches.
3. **Option 3: Comprehensive Everything-as-Code with Pragmatic State Governance (Selected)**
* Define 100% of infrastructure, workloads, DNS, IoT edge devices, and AI agents declaratively in Git.
* Enforce `git-crypt` for declarative secrets.
* Isolate mutable runtime state (databases, chat histories, active OAuth tokens) to persistent volumes (PVCs) governed by zero-drift merge mechanics (`mergeMode: merge`).
* Mandate `knowledge-wiki/agents/` as the **exclusive** home for all AI agent prompt definitions.
---
## Decision Outcome
Chosen Option: **Option 3: Comprehensive Everything-as-Code with Pragmatic State Governance**.
### 1. The Five Tiers of Everything as Code (EaC)
```
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Infrapuzzle Monorepo (Git) │
└────────────────────────────────────────────────┬─────────────────────────────────────────────────┘
│
┌──────────────────┬───────────────────────┼───────────────────────┬──────────────────┐
▼ ▼ ▼ ▼ ▼
┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐
│ Tier 1 │ │ Tier 2 │ │ Tier 3 │ │ Tier 4 │ │ Tier 5 │
│Bare-Metal │ │Kubernetes │ │Cloud & DNS│ │Smart Home │ │Agents as │
│Bootstrap │ │Workloads │ │ │ │& IoT Edge │ │Code (Wiki)│
├───────────┤ ├───────────┤ ├───────────┤ ├───────────┤ ├───────────┤
│• Kubespray│ │• Helm │ │• Terraform│ │• ESPHome │ │• Exclusive│
│• Ansible │ │• Manifests│ │ (OVH DNS)│ │• Shelly │ │ prompts │
│• init.sh │ │• Operators│ │• Mail DNS │ │ Terraform│ │• Tool │
│ │ │ (OpenClaw│ │ (MX/SPF/ │ │• BLE & │ │ bindings │
│ │ │ CRDs) │ │ DKIM) │ │ Sensors │ │• git-sync │
└─────┬─────┘ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘
│ │ │ │ │
▼ ▼ ▼ ▼ ▼
Hetzner Node Haumdaucher K8s Public DNS & Grabengasse 7 OpenClaw
Base OS Setup Cluster Engine Domain Records Physical Devices Conductor
```
#### Tier 1: Bare-Metal Server Provisioning (`bootstrap/`)
* **Tooling**: Kubespray, Ansible, Bash (`init.sh`).
* **Scope**: Operating system hardening, kernel modules, firewall rules, container runtime (containerd), and Kubernetes control plane setup on the single bare-metal node (Haumdaucher, `136.243.23.215`).
* **Source of Truth**: `bootstrap/init.sh` and version-pinned Kubespray playbooks.
#### Tier 2: Kubernetes Workloads & Operators (`k8s/`)
* **Tooling**: Raw Kubernetes manifests, Helm 3 values, and Kubernetes Custom Resource Definitions (CRDs).
* **Conventions**:
- Directory structure enforces namespace partitioning (`k8s/<namespace>/`).
- Workloads managed via declarative specifications (e.g. OpenClaw Operator `OpenClawInstance` CRD in `k8s/openclaw/openclaw-instance.secret.yaml`).
- Standardized ingress controller (`ingress-nginx` / `traefik`) with automated Let's Encrypt certificates (`cert-manager`).
#### Tier 3: External Infrastructure, DNS & Mail (`terraform/`)
* **Tooling**: Terraform with `ovh/ovh` provider.
* **Scope**:
- Authoritative DNS zones (`haumdaucher.de`, `moritzgraf.de`, `ameliegraf.de`, and others).
- Google Workspace mail routing (MX, SPF TXT, DKIM, DMARC records).
- Cluster IP mapping to the bare-metal ingress endpoint.
* **Execution**: Fully automated via `terraform plan` / `terraform apply` directly from version-controlled state.
#### Tier 4: Smart Home & IoT Edge Hardware (`terraform_shelly/`, `esphome/`, `monitoring/`)
* **Tooling**: ESPHome, Shelly Terraform Provider, YAML configs.
* **Scope**:
- Shelly relays and smart switches provisioned declaratively via Terraform.
- ESPHome firmware configurations for ESP32 Bluetooth proxies, Xiaomi BLE temperature/hygrometer sensors, and plant moisture monitors.
- All device configurations, pinouts, and network parameters committed to git; flashing performed deterministically from code.
#### Tier 5: Agents-as-Code & Knowledge Systems (`knowledge-wiki/agents/`)
* **Core Rule — Exclusive Single Source of Truth**:
> **All AI agent definitions (prompts, personas, operational boundaries, and tool calling instructions) MUST reside exclusively in [`knowledge-wiki/agents/<name>.md`](../../knowledge-wiki/agents/).**
* **Strict Architecture**:
- Agent behavior is never hardcoded inside container images, ad-hoc Helm values, or untracked local directories.
- Adding or modifying an agent is done purely by creating or editing a markdown specification in the `knowledge-wiki/agents/` directory (e.g. `hebamme.md`, `koch.md`, `grabengasse.md`, `fitness.md`, `recherche.md`).
- Workloads (such as OpenClaw) ingest these definitions dynamically via `git-sync` sidecars or submodules, enabling instantaneous updates without requiring pod restarts or image rebuilds.
- If agent prompts or specifications are discovered outside of `knowledge-wiki/agents/`, they must be refactored and consolidated into this directory.
---
## The Feasibility Boundary & State Governance
The user requirement explicitly dictates: *"we want to do everything as code as far as it is feasible and reproducible"*. To balance pure declarative code with stateful services, the boundary is defined as follows:
| Dimension | Managed as Code (Git) | Managed on Persistent Storage (PVC) |
| :--- | :--- | :--- |
| **Workload Topology** | Pod specs, replicas, resource limits, CRDs, Helm releases. | — |
| **Secrets & Keys** | Encrypted via `git-crypt` (`*.secret`, `*.secret.yaml`, `*.secret.values`). | Mounted into runtime memory/containers. |
| **Agent Behavior** | System prompts, personas, roles, tool manifests in `knowledge-wiki/agents/`. | Dynamic short-term conversation context, user memory (`MEMORY.md`). |
| **External Auth Tokens** | Initial static API keys and client credentials. | Volatile session tokens refreshed dynamically at runtime (e.g. Garmin OAuth tokens on PVC). |
| **Data Storage** | Schema migrations, DB connection configs, backup cronjobs. | Raw databases (PostgreSQL, SQLite), media files, Nextcloud files. |
| **Operator Integration** | Declarative base configurations (`spec.config.raw`). | Runtime mutations deep-merged safely via `mergeMode: merge` without overwriting runtime state. |
### Operational Governance Rules
1. **No Ad-Hoc `kubectl edit`**: Never modify cluster objects directly with `kubectl edit` or unrecorded commands. All modifications must be committed to git and applied via `kubectl apply -f <manifest>` or Helm.
2. **Git-Crypt Security Enforcement**: Any file containing API keys, private passwords, or private identities must match the `.gitattributes` pattern (`*.secret*`) and be locked with `git-crypt`.
3. **Reproducibility Guarantee**: In the event of total hardware loss, cloning `infrapuzzle` and unlocking `git-crypt` must be sufficient to run `bootstrap/init.sh`, apply Terraform, restore PVC backups from Velero/MinIO, and restore full operational state.
---
## Consequences
### Positive
* **100% Deterministic Disaster Recovery**: Eliminates mysterious configuration drift and allows full rebuilds of bare-metal, Kubernetes, DNS, and IoT systems.
* **Unified AI Agent Lifecycle**: Developers and AI assistants edit agent personalities, prompts, and skills in a single, version-controlled markdown directory (`knowledge-wiki/agents/`).
* **High Operational Velocity**: Changes to agent logic apply instantly via `git-sync` without container restarts or downtime.
* **Audit Trail**: Every change to infrastructure, DNS, smart home switches, or agent system prompts has an author, timestamp, and commit message.
### Negative & Mitigations
* **Discipline Overhead**: Even minor configuration changes require a git commit and deployment workflow rather than a quick UI click.
* *Mitigation*: Tooling like OpenClaw Operator automated rolling updates and `git-sync` minimizes deployment friction to a single `git push`.
* **Git-Crypt Dependency**: Operators and agents require the repository encryption key to modify secrets.
* *Mitigation*: Standardized symmetric key distribution and clear documentation in `k8s/AGENTS.md`.
docs/adr/README.md
+1
View File
@@ -12,6 +12,7 @@ We follow the [Markdown Architectural Decision Records (MADR)](https://adr.githu
| :--- | :--- | :---: | :---: | :--- |
| [**0001**](0001-hybrid-mcp-tool-search-and-subagents.md) | **Hybrid MCP Tool Search and Subagent Delegation for AI Agents** | `accepted` | 2026-09-12 | OpenClaw / AI / MCP |
| [**0002**](0002-openclaw-model-selection-tiering-and-economics.md) | **OpenClaw Multi-Tier Model Selection, Latency Optimization, and Inference Economics** | `proposed` | 2026-09-13 | OpenClaw / AI / Models |
| [**0003**](0003-everything-as-code-and-reproducible-infrastructure.md) | **Everything as Code (EaC) and Reproducible Declarative Infrastructure** | `accepted` | 2026-09-17 | Architecture / Monorepo / EaC |
---
k8s/openclaw/openclaw-instance.secret.yaml
BIN
View File
Binary file not shown.
k8s/openclaw/openclaw.secret.yaml
BIN
View File
Binary file not shown.
knowledge-wiki
+1 -1
Submodule knowledge-wiki updated: 84f0f858c2...5fe12084dc
terraform/gcp_apis.tf
+109
View File
@@ -0,0 +1,109 @@
locals {
openclaw_project_id = "octobot-486812"
}
# ------------------------------------------------------------------------------
# 1. API Services Enablement
# ------------------------------------------------------------------------------
resource "google_project_service" "apikeys_api" {
project = local.openclaw_project_id
service = "apikeys.googleapis.com"
disable_on_destroy = false
}
resource "google_project_service" "youtube_api" {
project = local.openclaw_project_id
service = "youtube.googleapis.com"
disable_on_destroy = false
}
resource "google_project_service" "routes_api" {
project = local.openclaw_project_id
service = "routes.googleapis.com"
disable_on_destroy = false
}
resource "google_project_service" "geocoding_api" {
project = local.openclaw_project_id
service = "geocoding-backend.googleapis.com"
disable_on_destroy = false
}
resource "google_project_service" "static_maps_api" {
project = local.openclaw_project_id
service = "static-maps-backend.googleapis.com"
disable_on_destroy = false
}
resource "google_project_service" "places_api" {
project = local.openclaw_project_id
service = "places.googleapis.com"
disable_on_destroy = false
}
# ------------------------------------------------------------------------------
# 2. Dedicated API Keys
# ------------------------------------------------------------------------------
resource "google_apikeys_key" "openclaw_youtube_key" {
name = "openclaw-youtube-key"
display_name = "OpenClaw YouTube API Key"
project = local.openclaw_project_id
restrictions {
api_targets {
service = "youtube.googleapis.com"
}
}
depends_on = [
google_project_service.apikeys_api,
google_project_service.youtube_api
]
}
resource "google_apikeys_key" "openclaw_google_maps_key" {
name = "openclaw-google-maps-key"
display_name = "OpenClaw Google Maps API Key"
project = local.openclaw_project_id
restrictions {
api_targets {
service = "places.googleapis.com"
}
api_targets {
service = "routes.googleapis.com"
}
api_targets {
service = "geocoding-backend.googleapis.com"
}
api_targets {
service = "static-maps-backend.googleapis.com"
}
}
depends_on = [
google_project_service.apikeys_api,
google_project_service.places_api,
google_project_service.routes_api,
google_project_service.geocoding_api,
google_project_service.static_maps_api
]
}
# ------------------------------------------------------------------------------
# 3. Outputs
# ------------------------------------------------------------------------------
output "openclaw_youtube_api_key" {
value = google_apikeys_key.openclaw_youtube_key.key_string
description = "API Key dedicated to YouTube Data API v3 for OpenClaw"
sensitive = true
}
output "openclaw_google_maps_api_key" {
value = google_apikeys_key.openclaw_google_maps_key.key_string
description = "API Key dedicated to Google Maps Platform for OpenClaw"
sensitive = true
}
terraform/terraform.tfstate
+254 -1
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 394,
"serial": 403,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -38,6 +38,16 @@
"value": "openclaw-calendar@octobot-486812.iam.gserviceaccount.com",
"type": "string"
},
"openclaw_google_maps_api_key": {
"value": "AIzaSyDiV8UJ6Lytr0rwuGZcObhjFiSY5Rvm03c",
"type": "string",
"sensitive": true
},
"openclaw_youtube_api_key": {
"value": "AIzaSyA3tUGk95e24p5pgHuniXkbqDCd5tVITOk",
"type": "string",
"sensitive": true
},
"velero_backup_sa_email": {
"value": "velero-backup-sa@velero-backup-dc8c8f74.iam.gserviceaccount.com",
"type": "string"
@@ -2704,6 +2714,117 @@
}
]
},
{
"mode": "managed",
"type": "google_apikeys_key",
"name": "openclaw_google_maps_key",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"display_name": "OpenClaw Google Maps API Key",
"id": "projects/octobot-486812/locations/global/keys/openclaw-google-maps-key",
"key_string": "AIzaSyDiV8UJ6Lytr0rwuGZcObhjFiSY5Rvm03c",
"name": "openclaw-google-maps-key",
"project": "octobot-486812",
"restrictions": [
{
"android_key_restrictions": [],
"api_targets": [
{
"methods": null,
"service": "places.googleapis.com"
},
{
"methods": null,
"service": "routes.googleapis.com"
},
{
"methods": null,
"service": "geocoding-backend.googleapis.com"
},
{
"methods": null,
"service": "static-maps-backend.googleapis.com"
}
],
"browser_key_restrictions": [],
"ios_key_restrictions": [],
"server_key_restrictions": []
}
],
"timeouts": null,
"uid": "45904264-9b7f-4004-b46a-df8cf2ee87fa"
},
"sensitive_attributes": [
[
{
"type": "get_attr",
"value": "key_string"
}
]
],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
"dependencies": [
"google_project_service.apikeys_api",
"google_project_service.geocoding_api",
"google_project_service.places_api",
"google_project_service.routes_api",
"google_project_service.static_maps_api"
]
}
]
},
{
"mode": "managed",
"type": "google_apikeys_key",
"name": "openclaw_youtube_key",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"display_name": "OpenClaw YouTube API Key",
"id": "projects/octobot-486812/locations/global/keys/openclaw-youtube-key",
"key_string": "AIzaSyA3tUGk95e24p5pgHuniXkbqDCd5tVITOk",
"name": "openclaw-youtube-key",
"project": "octobot-486812",
"restrictions": [
{
"android_key_restrictions": [],
"api_targets": [
{
"methods": null,
"service": "youtube.googleapis.com"
}
],
"browser_key_restrictions": [],
"ios_key_restrictions": [],
"server_key_restrictions": []
}
],
"timeouts": null,
"uid": "698b6db2-22a7-4caa-a728-10654289afa0"
},
"sensitive_attributes": [
[
{
"type": "get_attr",
"value": "key_string"
}
]
],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
"dependencies": [
"google_project_service.apikeys_api",
"google_project_service.youtube_api"
]
}
]
},
{
"mode": "managed",
"type": "google_project",
@@ -2802,6 +2923,28 @@
}
]
},
{
"mode": "managed",
"type": "google_project_service",
"name": "apikeys_api",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"disable_dependent_services": null,
"disable_on_destroy": false,
"id": "octobot-486812/apikeys.googleapis.com",
"project": "octobot-486812",
"service": "apikeys.googleapis.com",
"timeouts": null
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjYwMDAwMDAwMDAwMCwidXBkYXRlIjoxMjAwMDAwMDAwMDAwfX0="
}
]
},
{
"mode": "managed",
"type": "google_project_service",
@@ -2850,6 +2993,28 @@
}
]
},
{
"mode": "managed",
"type": "google_project_service",
"name": "geocoding_api",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"disable_dependent_services": null,
"disable_on_destroy": false,
"id": "octobot-486812/geocoding-backend.googleapis.com",
"project": "octobot-486812",
"service": "geocoding-backend.googleapis.com",
"timeouts": null
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjYwMDAwMDAwMDAwMCwidXBkYXRlIjoxMjAwMDAwMDAwMDAwfX0="
}
]
},
{
"mode": "managed",
"type": "google_project_service",
@@ -2872,6 +3037,94 @@
}
]
},
{
"mode": "managed",
"type": "google_project_service",
"name": "places_api",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"disable_dependent_services": null,
"disable_on_destroy": false,
"id": "octobot-486812/places.googleapis.com",
"project": "octobot-486812",
"service": "places.googleapis.com",
"timeouts": null
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjYwMDAwMDAwMDAwMCwidXBkYXRlIjoxMjAwMDAwMDAwMDAwfX0="
}
]
},
{
"mode": "managed",
"type": "google_project_service",
"name": "routes_api",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"disable_dependent_services": null,
"disable_on_destroy": false,
"id": "octobot-486812/routes.googleapis.com",
"project": "octobot-486812",
"service": "routes.googleapis.com",
"timeouts": null
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjYwMDAwMDAwMDAwMCwidXBkYXRlIjoxMjAwMDAwMDAwMDAwfX0="
}
]
},
{
"mode": "managed",
"type": "google_project_service",
"name": "static_maps_api",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"disable_dependent_services": null,
"disable_on_destroy": false,
"id": "octobot-486812/static-maps-backend.googleapis.com",
"project": "octobot-486812",
"service": "static-maps-backend.googleapis.com",
"timeouts": null
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjYwMDAwMDAwMDAwMCwidXBkYXRlIjoxMjAwMDAwMDAwMDAwfX0="
}
]
},
{
"mode": "managed",
"type": "google_project_service",
"name": "youtube_api",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"disable_dependent_services": null,
"disable_on_destroy": false,
"id": "octobot-486812/youtube.googleapis.com",
"project": "octobot-486812",
"service": "youtube.googleapis.com",
"timeouts": null
},
"sensitive_attributes": [],
"identity_schema_version": 0,
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjYwMDAwMDAwMDAwMCwidXBkYXRlIjoxMjAwMDAwMDAwMDAwfX0="
}
]
},
{
"mode": "managed",
"type": "google_service_account",
terraform/terraform.tfstate.backup
+89 -1
View File
@@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.14.3",
"serial": 391,
"serial": 394,
"lineage": "8aff5d23-05f6-10eb-0ae6-1084c787677e",
"outputs": {
"coder_oauth_client_secret": {
@@ -2936,6 +2936,46 @@
}
]
},
{
"mode": "managed",
"type": "google_service_account_key",
"name": "openclaw_calendar_sa_key",
"provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"id": "projects/octobot-486812/serviceAccounts/openclaw-calendar@octobot-486812.iam.gserviceaccount.com/keys/8c4c1f09033546fffe2fe9b85a54a0206bd8d57c",
"keepers": null,
"key_algorithm": "KEY_ALG_RSA_2048",
"name": "projects/octobot-486812/serviceAccounts/openclaw-calendar@octobot-486812.iam.gserviceaccount.com/keys/8c4c1f09033546fffe2fe9b85a54a0206bd8d57c",
"private_key": "ewogICJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsCiAgInByb2plY3RfaWQiOiAib2N0b2JvdC00ODY4MTIiLAogICJwcml2YXRlX2tleV9pZCI6ICI4YzRjMWYwOTAzMzU0NmZmZmUyZmU5Yjg1YTU0YTAyMDZiZDhkNTdjIiwKICAicHJpdmF0ZV9rZXkiOiAiLS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5NSUlFdmdJQkFEQU5CZ2txaGtpRzl3MEJBUUVGQUFTQ0JLZ3dnZ1NrQWdFQUFvSUJBUURkN2dzVytPT2o1dzdhXG53dXI3akRFV0QyelJkWXpzT1dXVjNzZDVQdkttOGVaVmlJWGhGY0ZseU5PMzdNMXVKSHI0SERJTDFHdkxTc2RZXG54dlQySXNCQys5d1doOTdhaUVab1l0TDE5K0g2ZVFmUloycGlnWjJIamJPdlYrZmtCSDYvUzNPSGh5RW1DUjl3XG5tQXgzTTFOTFBvWFJLQmRJWTVJWE8rclNIZC9ZYmgyQnBERjl5THc3Y0RhL09KeWZGRThIbGtSZkdUbmJIdWlCXG4rZ3dra3B3TTY5Q3FkM1p4VFR1bFEvck1xazBSZ09iZTluaEQrZlZ1MWl0Mms2ejVDV1ViNWpJazZvVWpjNENVXG43UFZZRWg1S2owVUJPSU1qcXZ3bHArZjdJV3dSWnpuMitvWHBodTVYR3JHeXRCVTF3Zm42UjRtSERaV1pKNmFmXG5vWTliMlhUbEFnTUJBQUVDZ2dFQUFJM0hpN3ZlUlY3OHNjLzN0bVFXQVVYcjlsWHltSHlha0FoeDd5SVNpTFd4XG5CVEtITUNVRGxsOTJWUEJLQ1BPWG85TWE4eitER2dVSTk3TS9tSEFJQUY0NFpFUUFsWDBUSktyczhXdDdRR0w2XG5zbE1uZXlydE5hUVVrN0JmQkp0OGRIQ1FtS1dVL2NNTDFBUDcrcVZwUXpUaEYvM2lnR3NOM0NoMW50Myt2ZnlMXG5qWFJPTGlka0FMZ250L1ZxS0lHalBKQ2daNFhaVDY2VFBFOG1pVWkrYzUyWEhwK250Y0JuMmlIMGYzU2YxSHJjXG5TL01lYllZUmZTd0Era1hyZzVwR3VRMEVoU1pscmNqejhXWGFEeWVsNnh3cGh5aDJ2ZTJnNzBld2NGazFHbGR5XG55OVhFd0lZdGpobG5IajRpWVRwYWNxWXlORXNyM3pITzNVZ1Bzc3hXUndLQmdRRHpKdVBTcHlEQm1uMzYydFhoXG5kanhBSDNZcy9kMlhqM1A5cXBmVFN6M2VjMHMySkc1QTVDY3dFZ1A0eklsRE1yclZOWFVnYXZBeEhaS0VXMWc4XG5vdHBrbFJkZUI4dEx3YWtkUFA2M2xCZW0xdmdVak56WlZnQ0JTSjI2bFliNDJoZXp4VmxuUExVb0JNNjUvMW9oXG56TEpBbithSVN1MElVWVN1QkI2ZGVnOFhyd0tCZ1FEcHFCVklLeElzZUt3VVNKUlc0WFZKdkVBZHRJcmR6WlFXXG52U05ucjdYVVo2aWU5WVkrOEtseEwweHdDOTBpaHpFVkRYR0w2YlFRM1V0NEF5RmlzcmNMdDQxRjkvdUhFRG56XG5Jd2dzVURIaDcwV0tjU3B3UjdOWFEvZ0ZLWHUwYnpWTGRpMWdHN3E2OThNUytpMVZwS21FdWJZRldib1ovazdXXG5aMDFpTk90TnF3S0JnUUM4clFLL3BSd1AzdmUrdml5VTVSQmZtWW96NDFJZGx4MGtTMG5BbFhRT3QxdzNTUkdjXG5uTzJqcVhjWGltOUFpNDdhZnI3Q1J2ald3K0c3ZnIzN1gwc2tIV1NpZkYzT0RScFRLODlqV0RENkwza1ZTVERlXG5ISlFMdmZOV28weTJzVlVQRkNZSnE5dk9qOXh5QzZrKzdQMnNrK2RvL3Vyck40WkRHY00vNDBUdTFRS0JnUUNDXG5UWjR3dFBSWm9LSTJYWk44TUJkOG0yTVdMYzBUak1YOU9GVTZTWjhaYVFWOFFHZ3hTWHoxQmUrV3ZNY0JybXNNXG4xb1p3QkZESzV0NWplenR2RTBOSllYK0RlWnZuNG9DdXV1YWY3OGtodXBJSmRycTRDd1JVc2k3cWtndk93QVgwXG5vMThDcmZRZ3VITXRiaDlDRjZZQndwOWp0SG80Ykw0Q2kzRjRSeExDS1FLQmdBek5zVzZjQjQyWG5HbFVlbjd3XG5CaFh6dTNOL2doRUVQZ3FuUjUydmttR2NGYzl3Q1cxNnEzaEJnZk40OVdPQmh0MnUzSlRjYWZ6emhFazE5WFJiXG5QZDlTalkwZlBNUnBiVUJkKzJkQWdCWXpNa3pyUmJaZlYrc0daaFNSQ0JHS2UvUVgwcitvM0xmeUF1VHo2c2Z3XG5uaEVvYU1UdXJxT0tXKzRMcmFPbTI3YXpcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbiIsCiAgImNsaWVudF9lbWFpbCI6ICJvcGVuY2xhdy1jYWxlbmRhckBvY3RvYm90LTQ4NjgxMi5pYW0uZ3NlcnZpY2VhY2NvdW50LmNvbSIsCiAgImNsaWVudF9pZCI6ICIxMDUzMTgzOTU2NDgzODA1MDgxODUiLAogICJhdXRoX3VyaSI6ICJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20vby9vYXV0aDIvYXV0aCIsCiAgInRva2VuX3VyaSI6ICJodHRwczovL29hdXRoMi5nb29nbGVhcGlzLmNvbS90b2tlbiIsCiAgImF1dGhfcHJvdmlkZXJfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9vYXV0aDIvdjEvY2VydHMiLAogICJjbGllbnRfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9yb2JvdC92MS9tZXRhZGF0YS94NTA5L29wZW5jbGF3LWNhbGVuZGFyJTQwb2N0b2JvdC00ODY4MTIuaWFtLmdzZXJ2aWNlYWNjb3VudC5jb20iLAogICJ1bml2ZXJzZV9kb21haW4iOiAiZ29vZ2xlYXBpcy5jb20iCn0K",
"private_key_type": "TYPE_GOOGLE_CREDENTIALS_FILE",
"public_key": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvVENDQWVXZ0F3SUJBZ0lKQU0vWjRmdFpSTFVJTUEwR0NTcUdTSWIzRFFFQkJRVUFNQ0F4SGpBY0JnTlYKQkFNTUZURXdOVE14T0RNNU5UWTBPRE00TURVd09ERTROVEFnRncweU5qQTVNVFV4T1RNME16QmFHQTg1T1RrNQpNVEl6TVRJek5UazFPVm93SURFZU1Cd0dBMVVFQXd3Vk1UQTFNekU0TXprMU5qUTRNemd3TlRBNE1UZzFNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUEzZTRMRnZqam8rY08yc0xxKzR3eEZnOXMKMFhXTTdEbGxsZDdIZVQ3eXB2SG1WWWlGNFJYQlpjalR0K3pOYmlSNitCd3lDOVJyeTBySFdNYjA5aUxBUXZ2YwpGb2ZlMm9oR2FHTFM5ZmZoK25rSDBXZHFZb0dkaDQyenIxZm41QVIrdjB0emg0Y2hKZ2tmY0pnTWR6TlRTejZGCjBTZ1hTR09TRnp2cTBoM2YyRzRkZ2FReGZjaThPM0EydnppY254UlBCNVpFWHhrNTJ4N29nZm9NSkpLY0RPdlEKcW5kMmNVMDdwVVA2ektwTkVZRG0zdlo0US9uMWJ0WXJkcE9zK1FsbEcrWXlKT3FGSTNPQWxPejFXQkllU285RgpBVGlESTZyOEphZm4reUZzRVdjNTl2cUY2WWJ1VnhxeHNyUVZOY0g1K2tlSmh3MlZtU2VtbjZHUFc5bDA1UUlECkFRQUJvemd3TmpBTUJnTlZIUk1CQWY4RUFqQUFNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVdCZ05WSFNVQkFmOEUKRERBS0JnZ3JCZ0VGQlFjREFqQU5CZ2txaGtpRzl3MEJBUVVGQUFPQ0FRRUFEckRLT3VEZG03ZWU1dy9SMEp3NQp4ekptT0ZoYmpkWUJ3MklucXI3ZlVGMHVsMk56SlU4TmVtOFltT1FxcytBYUhKMVJlMHM2YllNak95Z3VCbFY3Ckxsdnhra1IvMWUxekFQRjhsRDRBYTR3N2luM3kxb3k1NW9sbFpTWjBtTDgwUERObGxEUGRkRkMveHpuOGYxRmMKUnB5MjhEempUbDdIVEJnbXMxTEhSWms1TE1PTVp1UUhXcGpXWkJlczMyZUZHNGNJMlJQNk01OUpCNlFVdWJjZApwa2JWVDJGOUhwbDhoN01pVjFYTUQwWmRIZjR6aUFPcGxCSzBISWJkanVyNEMzR0t1aGdrS0pGK3p5cWdoR3FwCnVPWkVuRDBjQ0Q0ZCthNFRmZUtyb2xPSklmKytDRUxEWWF6NEpuQlloaDBSakZnZTduM21YK0VrRzNrQ1dkVUIKYVE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==",
"public_key_data": null,
"public_key_type": "TYPE_X509_PEM_FILE",
"service_account_id": "projects/octobot-486812/serviceAccounts/openclaw-calendar@octobot-486812.iam.gserviceaccount.com",
"valid_after": "2026-09-15T19:34:30Z",
"valid_before": "9999-12-31T23:59:59Z"
},
"sensitive_attributes": [
[
{
"type": "get_attr",
"value": "private_key"
}
]
],
"identity_schema_version": 0,
"private": "bnVsbA==",
"dependencies": [
"google_project_organization_policy.allow_calendar_key_creation",
"google_project_service.calendar_api",
"google_service_account.openclaw_calendar_sa"
]
}
]
},
{
"mode": "managed",
"type": "google_service_account_key",
@@ -3028,6 +3068,54 @@
}
]
},
{
"mode": "managed",
"type": "local_file",
"name": "openclaw_calendar_sa_key_file",
"provider": "provider[\"registry.terraform.io/hashicorp/local\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"content": "{\n \"type\": \"service_account\",\n \"project_id\": \"octobot-486812\",\n \"private_key_id\": \"8c4c1f09033546fffe2fe9b85a54a0206bd8d57c\",\n \"private_key\": \"-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDd7gsW+OOj5w7a\\nwur7jDEWD2zRdYzsOWWV3sd5PvKm8eZViIXhFcFlyNO37M1uJHr4HDIL1GvLSsdY\\nxvT2IsBC+9wWh97aiEZoYtL19+H6eQfRZ2pigZ2HjbOvV+fkBH6/S3OHhyEmCR9w\\nmAx3M1NLPoXRKBdIY5IXO+rSHd/Ybh2BpDF9yLw7cDa/OJyfFE8HlkRfGTnbHuiB\\n+gwkkpwM69Cqd3ZxTTulQ/rMqk0RgObe9nhD+fVu1it2k6z5CWUb5jIk6oUjc4CU\\n7PVYEh5Kj0UBOIMjqvwlp+f7IWwRZzn2+oXphu5XGrGytBU1wfn6R4mHDZWZJ6af\\noY9b2XTlAgMBAAECggEAAI3Hi7veRV78sc/3tmQWAUXr9lXymHyakAhx7yISiLWx\\nBTKHMCUDll92VPBKCPOXo9Ma8z+DGgUI97M/mHAIAF44ZEQAlX0TJKrs8Wt7QGL6\\nslMneyrtNaQUk7BfBJt8dHCQmKWU/cML1AP7+qVpQzThF/3igGsN3Ch1nt3+vfyL\\njXROLidkALgnt/VqKIGjPJCgZ4XZT66TPE8miUi+c52XHp+ntcBn2iH0f3Sf1Hrc\\nS/MebYYRfSwA+kXrg5pGuQ0EhSZlrcjz8WXaDyel6xwphyh2ve2g70ewcFk1Gldy\\ny9XEwIYtjhlnHj4iYTpacqYyNEsr3zHO3UgPssxWRwKBgQDzJuPSpyDBmn362tXh\\ndjxAH3Ys/d2Xj3P9qpfTSz3ec0s2JG5A5CcwEgP4zIlDMrrVNXUgavAxHZKEW1g8\\notpklRdeB8tLwakdPP63lBem1vgUjNzZVgCBSJ26lYb42hezxVlnPLUoBM65/1oh\\nzLJAn+aISu0IUYSuBB6deg8XrwKBgQDpqBVIKxIseKwUSJRW4XVJvEAdtIrdzZQW\\nvSNnr7XUZ6ie9YY+8KlxL0xwC90ihzEVDXGL6bQQ3Ut4AyFisrcLt41F9/uHEDnz\\nIwgsUDHh70WKcSpwR7NXQ/gFKXu0bzVLdi1gG7q698MS+i1VpKmEubYFWboZ/k7W\\nZ01iNOtNqwKBgQC8rQK/pRwP3ve+viyU5RBfmYoz41Idlx0kS0nAlXQOt1w3SRGc\\nnO2jqXcXim9Ai47afr7CRvjWw+G7fr37X0skHWSifF3ODRpTK89jWDD6L3kVSTDe\\nHJQLvfNWo0y2sVUPFCYJq9vOj9xyC6k+7P2sk+do/urrN4ZDGcM/40Tu1QKBgQCC\\nTZ4wtPRZoKI2XZN8MBd8m2MWLc0TjMX9OFU6SZ8ZaQV8QGgxSXz1Be+WvMcBrmsM\\n1oZwBFDK5t5jeztvE0NJYX+DeZvn4oCuuuaf78khupIJdrq4CwRUsi7qkgvOwAX0\\no18CrfQguHMtbh9CF6YBwp9jtHo4bL4Ci3F4RxLCKQKBgAzNsW6cB42XnGlUen7w\\nBhXzu3N/ghEEPgqnR52vkmGcFc9wCW16q3hBgfN49WOBht2u3JTcafzzhEk19XRb\\nPd9SjY0fPMRpbUBd+2dAgBYzMkzrRbZfV+sGZhSRCBGKe/QX0r+o3LfyAuTz6sfw\\nnhEoaMTurqOKW+4LraOm27az\\n-----END PRIVATE KEY-----\\n\",\n \"client_email\": \"openclaw-calendar@octobot-486812.iam.gserviceaccount.com\",\n \"client_id\": \"105318395648380508185\",\n \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n \"token_uri\": \"https://oauth2.googleapis.com/token\",\n \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/openclaw-calendar%40octobot-486812.iam.gserviceaccount.com\",\n \"universe_domain\": \"googleapis.com\"\n}\n",
"content_base64": null,
"content_base64sha256": "1jrhzIn0pbhdcVAP1SpuayMU1K12I/7z10zXyKihk8w=",
"content_base64sha512": "JBxoJmS3e8QQdWHyms9ABX+rnKMsy/6AQg84DQXX+A9j33hhJ3gC0RTYfOcwk7D3HFFWWlJPEg++fK/nQkWWHA==",
"content_md5": "f18cfc72834e50c7dacb4f879f63a5a2",
"content_sha1": "e7e89bd3ce694c7d7eadb0dab89db8d84014dc1d",
"content_sha256": "d63ae1cc89f4a5b85d71500fd52a6e6b2314d4ad7623fef3d74cd7c8a8a193cc",
"content_sha512": "241c682664b77bc4107561f29acf40057fab9ca32ccbfe80420f380d05d7f80f63df7861277802d114d87ce73093b0f71c51565a524f120fbe7cafe74245961c",
"directory_permission": "0777",
"file_permission": "0777",
"filename": "./../k8s/openclaw/calendar_sa.json.secret",
"id": "e7e89bd3ce694c7d7eadb0dab89db8d84014dc1d",
"sensitive_content": null,
"source": null
},
"sensitive_attributes": [
[
{
"type": "get_attr",
"value": "content"
}
],
[
{
"type": "get_attr",
"value": "sensitive_content"
}
]
],
"identity_schema_version": 0,
"dependencies": [
"google_project_organization_policy.allow_calendar_key_creation",
"google_project_service.calendar_api",
"google_service_account.openclaw_calendar_sa",
"google_service_account_key.openclaw_calendar_sa_key"
]
}
]
},
{
"mode": "managed",
"type": "ovh_domain_zone_record",