terraform {
  required_version = ">= 1.11.0"

  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 5.7.0"
    }
  }

  backend "s3" {}
}

provider "vault" {
  address          = var.vault_addr
  skip_child_token = true
  token            = var.vault_token
}

locals {
  workload_policy_dir = "${path.module}/../../../../../policies/vault/dev-k3s/workloads"

  jwt_transit_key_name      = "project-auth-jwt"
  kubernetes_auth_path      = "kubernetes"
  kubernetes_token_audience = "vault"
  transit_mount_path        = "transit"

  workload_policies = {
    auth-server-dev          = file("${local.workload_policy_dir}/auth-server-dev.hcl")
    auth-db-migration-dev    = file("${local.workload_policy_dir}/auth-db-migration-dev.hcl")
    postgres-dev             = file("${local.workload_policy_dir}/postgres-dev.hcl")
    keycloak-dev             = file("${local.workload_policy_dir}/keycloak-dev.hcl")
    keycloak-client-sync-dev = file("${local.workload_policy_dir}/keycloak-client-sync-dev.hcl")
  }
}

module "workload_policies" {
  source = "../../../modules/vault-policy-set"

  policies = local.workload_policies
}

module "workload_roles" {
  source = "../../../modules/vault-kubernetes-roles"

  backend = local.kubernetes_auth_path
  roles = {
    auth-server-dev = {
      audiences                  = [local.kubernetes_token_audience]
      service_account_names      = ["auth-server"]
      service_account_namespaces = ["auth-dev"]
      token_policies             = [module.workload_policies.names["auth-server-dev"]]
      token_ttl                  = var.kubernetes_role_ttl_seconds
    }
    auth-db-migration-dev = {
      audiences                  = [local.kubernetes_token_audience]
      service_account_names      = ["auth-db-migration"]
      service_account_namespaces = ["auth-dev"]
      token_policies             = [module.workload_policies.names["auth-db-migration-dev"]]
      token_ttl                  = var.kubernetes_role_ttl_seconds
    }
    postgres-dev = {
      audiences                  = [local.kubernetes_token_audience]
      service_account_names      = ["postgres"]
      service_account_namespaces = ["auth-system-dev"]
      token_policies             = [module.workload_policies.names["postgres-dev"]]
      token_ttl                  = var.kubernetes_role_ttl_seconds
    }
    keycloak-dev = {
      audiences                  = [local.kubernetes_token_audience]
      service_account_names      = ["keycloak"]
      service_account_namespaces = ["auth-system-dev"]
      token_policies             = [module.workload_policies.names["keycloak-dev"]]
      token_ttl                  = var.kubernetes_role_ttl_seconds
    }
    keycloak-client-sync-dev = {
      audiences                  = [local.kubernetes_token_audience]
      service_account_names      = ["keycloak-client-sync"]
      service_account_namespaces = ["auth-system-dev"]
      token_policies             = [module.workload_policies.names["keycloak-client-sync-dev"]]
      token_ttl                  = var.kubernetes_role_ttl_seconds
    }
  }
}

resource "vault_transit_secret_backend_key" "project_auth_jwt" {
  backend          = local.transit_mount_path
  deletion_allowed = false
  name             = local.jwt_transit_key_name
  type             = "rsa-2048"

  lifecycle {
    prevent_destroy = true
  }
}