terraform {
  required_version = ">= 1.6.0"

  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 4.8.0"
    }
  }

  backend "local" {
    path = "../../../.terraform-state/vault-transit-reconcile.tfstate"
  }
}

provider "vault" {
  address          = var.vault_addr
  skip_child_token = true
  token            = var.vault_token
}

locals {
  workflow_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-automation-dev.hcl"
  workload_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/workload-vault-transit-dev.hcl"
  admin_policy_path    = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-admin-dev.hcl"
}

resource "vault_policy" "workload_vault_transit_dev" {
  name   = var.workload_policy_name
  policy = file(local.workload_policy_path)
}

resource "vault_policy" "vault_transit_admin_dev" {
  name   = var.admin_policy_name
  policy = file(local.admin_policy_path)
}

resource "vault_policy" "vault_transit_automation_dev" {
  name   = var.workflow_policy_name
  policy = file(local.workflow_policy_path)
}

resource "vault_approle_auth_backend_role" "workflow" {
  backend            = var.approle_auth_path
  role_name          = var.workflow_role_name
  secret_id_num_uses = 0
  secret_id_ttl      = 0
  token_max_ttl      = var.workflow_token_max_ttl_seconds
  token_policies     = [vault_policy.vault_transit_automation_dev.name]
  token_ttl          = var.workflow_token_ttl_seconds
}