OVHcloud Managed Database

ovh-managed-database

An OVHcloud Managed Database cluster — PostgreSQL, MySQL, Kafka, MongoDB, Redis/Valkey, OpenSearch, Cassandra, M3DB or Grafana — with a deny-by-default IP trust list, optional generic users, and private-network (vRack) node placement.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the ovh/ovh provider. Not yet applied against a live OVHcloud project, so it ships under live-test quarantine (no cloud sandbox account yet).

Design & secure defaults

• Deny-by-default ingress. The cluster authorizes no inbound source until you populate ip_restrictions with explicit CIDR blocks. Each entry is CIDR-validated. (This uses the standalone ovh_cloud_project_database_ip_restriction resource, keyed for clean diffs.)
• Deletion protection on. deletion_protection = true guards against accidental teardown; set false to allow destroy.
• Private networking ready. Each node block accepts a network_id (vRack/openstackId) + subnet_id; a validation enforces that all nodes share the same region and network so you cannot mix public and private nodes.
• Generic users handled safely. users creates accounts via the generic user resource, which OVH supports only for mysql, cassandra, kafka, and grafana. A precondition rejects users on other engines (postgresql, mongodb, redis use dedicated user resources) rather than silently failing. Generated passwords are exposed only through the sensitive output.
• No hardcoded secrets. Credentials come from the provider block / environment.

The engine matrix is wide; OVH constrains valid version/flavor/plan combinations per engine. Test one engine per run.

Usage

module "database" {
  source = "github.com/ITfreak/iacbazaar//artifacts/terraform/ovh-managed-database"

  service_name   = "00000000000000000000000000000000"
  engine         = "postgresql"
  engine_version = "16"
  plan           = "essential"
  flavor         = "db1-4"

  nodes = [{ region = "GRA" }]

  ip_restrictions = {
    office = { ip = "203.0.113.0/24", description = "office egress" }
  }
}

See examples/basic for a complete configuration.

Key inputs

Variable	Description	Default
service_name	Public cloud project id (project-scoped API keys)	required
engine	Engine (postgresql, mysql, kafka, …)	required
engine_version	Engine version (e.g. 16)	required
plan	essential / business / enterprise	essential
flavor	Node flavor (e.g. db1-4)	db1-4
nodes	List of node blocks (region, optional network_id/subnet_id)	one GRA node
disk_size	Disk size in GB	null (flavor default)
ip_restrictions	Map of allowed CIDR blocks (deny-by-default)	{}
users	Generic users (mysql/cassandra/kafka/grafana only)	[]
deletion_protection	Block accidental deletes	true
advanced_configuration	Engine key/value tuning	{}
backup_time / maintenance_time	Daily/weekly windows (HH:MM:SS UTC)	null

Outputs

cluster_id, status, engine, version, network_type, disk_type, endpoints (sensitive), user_ids, user_passwords (sensitive), ip_restriction_status.

Provider

ovh/ovh >= 2.0, < 3.0. Requires Terraform/OpenTofu >= 1.6.

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.