Exoscale DBaaS

exoscale-dbaas

An Exoscale DBaaS managed database — PostgreSQL, MySQL, or Kafka (Aiven-backed) — with a deny-by-default IP filter, termination protection, and, for PostgreSQL, declaratively-managed logical databases and users. Targets EU-sovereign zones (CH / AT / DE).

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the exoscale/exoscale provider. Not yet applied against a live Exoscale account, so it ships under live-test quarantine.

Design & secure defaults

• One engine, selected by type. Set type to pg, mysql, or kafka; the module renders the matching engine block (the blocks are mutually exclusive). Engine version, backup schedule, and raw engine settings are shared inputs applied to whichever engine is active.
• Deny-by-default network exposure. ip_filter is empty by default, which denies all external sources. Add operator/app CIDRs explicitly; TLS is always required (the CA certificate is exported as a sensitive output).
• Termination protection on to prevent accidental deletion / power-off.
• Kafka enforces mTLS. kafka_enable_cert_auth = true by default; SASL is off unless explicitly enabled.
• Managed PostgreSQL objects. pg_databases and pg_users create logical databases and users when type = "pg". User passwords are generated by the service and surfaced via the sensitive pg_user_passwords output — secrets are never used as for_each keys. A precondition rejects pg-only objects for non-pg engines.

Plan names drift. DBaaS plans are Aiven-backed and renamed over time. Confirm the current plan for your type/zone with exo dbaas type show <type> --plans before applying.

Usage

module "pg" {
  source = "github.com/ITfreak/iacbazaar//artifacts/terraform/exoscale-dbaas"

  name = "orders"
  type = "pg"
  plan = "startup-4"
  zone = "ch-gva-2"

  ip_filter = ["203.0.113.0/24"]

  pg_databases = { app = {} }
  pg_users     = { app_rw = {} }
}

See examples/basic for a complete configuration.

Key inputs

Variable	Description	Default
name	Service name	required
type	pg / mysql / kafka	pg
plan	Aiven-backed plan slug	startup-4
zone	Exoscale zone (CH/AT/DE sovereign)	ch-gva-2
ip_filter	Allowed inbound CIDRs	[] (deny all)
termination_protection	Block deletion	true
engine_version	Engine major version	null (engine default)
backup_schedule	Daily backup HH:MM (pg/mysql)	null
pg_settings / mysql_settings / kafka_settings	Raw JSON engine settings	null
kafka_enable_cert_auth / kafka_enable_sasl_auth	Kafka auth	true / false
pg_databases	Logical DBs (pg only)	{}
pg_users	DB users (pg only)	{}
maintenance_dow / maintenance_time	Maintenance window	sunday / 03:00:00

Outputs

service_id, service_name, type, zone, state, nodes, disk_size, ca_certificate (sensitive), pg_database_names, pg_user_names, pg_user_passwords (sensitive map).

Provider

exoscale/exoscale ~> 0.69. Requires Terraform/OpenTofu >= 1.6.

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.