fix(terraform): rotate Caddy service principal secret yearly

terraform/entra_apps.tf

@@ -16,6 +16,19 @@ resource "azuread_service_principal" "caddy" {
   }
 }
 
+# Entra ID gives client secrets a 2-year lifetime by default. Rotate the Caddy
+# secret yearly so it is replaced well before it expires; otherwise Caddy's
+# ACME DNS-01 challenge silently fails and the apt/yum TLS certificates lapse.
+# After this clock trips, `terraform apply` creates a new secret and the Ansible
+# playbook must be re-run to push it to the VM.
+resource "time_rotating" "caddy_password" {
+  rotation_days = 365
+}
+
 resource "azuread_service_principal_password" "caddy" {
   service_principal_id = azuread_service_principal.caddy.object_id
+
+  rotate_when_changed = {
+    rotation = time_rotating.caddy_password.id
+  }
 }

terraform/providers.tf

@@ -14,6 +14,11 @@ terraform {
       source  = "hashicorp/google"
       version = "~> 5.38.0"
     }
+
+    time = {
+      source  = "hashicorp/time"
+      version = "~> 0.12.1"
+    }
   }
 
   required_version = ">= 1.5"