terraform {
  required_version = ">= 1.11.0, < 2.0.0"

  backend "pg" {
    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
    schema_name = "ext_cf_tunnel"
  }

  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "5.22.0"
    }
    vault = {
      source  = "hashicorp/vault"
      version = "5.10.1"
    }
  }
}

provider "vault" {}

ephemeral "vault_kv_secret_v2" "tunnel_configuration" {
  mount = "secret"
  name  = "cloudflare/tier-o-tunnel-config"
}

ephemeral "vault_kv_secret_v2" "public_dns" {
  mount = "secret"
  name  = "cloudflare/pages-infrastructure"
}

ephemeral "vault_kv_secret_v2" "cache_rules" {
  mount = "secret"
  name  = "cloudflare/forge-cache"
}

ephemeral "vault_kv_secret_v2" "waf_edit" {
  mount = "secret"
  name  = "cloudflare/waf-edit"
}

provider "cloudflare" {
  alias     = "tunnel"
  api_token = ephemeral.vault_kv_secret_v2.tunnel_configuration.data["api-token"]
}

provider "cloudflare" {
  alias     = "public_dns"
  api_token = ephemeral.vault_kv_secret_v2.public_dns.data["api-token"]
}

provider "cloudflare" {
  alias     = "cache"
  api_token = ephemeral.vault_kv_secret_v2.cache_rules.data["api-token"]
}

provider "cloudflare" {
  alias     = "waf"
  api_token = ephemeral.vault_kv_secret_v2.waf_edit.data["api-token"]
}