Allow additional trusted sources on database firewall

[grovecj]

Summary

• The database firewall resource is declarative/exclusive — when terraform apply runs, it sets the entire firewall, removing any rules added by other projects
• The cartergrove-me droplet (ID: 550247439) needs access to the same database, causing conflicts
• Adds a configurable additional_trusted_sources variable that accepts any DO trusted source type (app, droplet, k8s, ip_addr, tag)

Usage

In terraform.tfvars:

additional_trusted_sources = [
  {
    type  = "droplet"
    value = "droplet_id"
  }
]

Test plan

• Run terraform plan to verify the droplet rule is added alongside the existing app rule
• Run terraform apply and confirm both mlb-stats app and cartergrove-me droplet appear in database trusted sources
• Verify mlb-stats app can connect to the database
• Verify cartergrove-me can connect to the database

🤖 Generated with Claude Code