data "vault_generic_secret" "public" {
  path = "secret/short/public"
}

resource "oci_identity_user" "short" {
  provider       = oci.home
  compartment_id = local.tenancy
  name           = "short"
  description    = "Tier S IPsec reconciliation"
  email          = data.vault_generic_secret.config.data["publisher_email"]
}

resource "oci_identity_group" "short" {
  provider       = oci.home
  compartment_id = local.tenancy
  name           = "short"
  description    = "Tier S IPsec reconciliation"
}

resource "oci_identity_user_group_membership" "short" {
  provider = oci.home
  user_id  = oci_identity_user.short.id
  group_id = oci_identity_group.short.id
}

resource "oci_identity_api_key" "short" {
  provider  = oci.home
  user_id   = oci_identity_user.short.id
  key_value = data.vault_generic_secret.public.data["public_key"]
}

resource "oci_identity_user_capabilities_management" "short" {
  provider                     = oci.home
  user_id                      = oci_identity_user.short.id
  can_use_api_keys             = true
  can_use_auth_tokens          = false
  can_use_console_password     = false
  can_use_customer_secret_keys = false
  can_use_smtp_credentials     = false
}

resource "oci_identity_policy" "short" {
  provider       = oci.home
  compartment_id = local.tenancy
  name           = "short"
  description    = "Tier S controller owns CPE and IPsec within its compartment"
  statements = [
    "Allow group ${oci_identity_group.short.name} to manage cpes in compartment id ${oci_identity_compartment.ingress.id}",
    "Allow group ${oci_identity_group.short.name} to manage ipsec-connections in compartment id ${oci_identity_compartment.ingress.id}",
    "Allow group ${oci_identity_group.short.name} to use drgs in compartment id ${oci_identity_compartment.ingress.id}"
  ]
}

resource "vault_kv_secret_v2" "cloud" {
  mount = "secret"
  name  = "short/cloud"
  data_json = jsonencode({ config = jsonencode({
    tenancy     = local.tenancy
    user        = oci_identity_user.short.id
    fingerprint = oci_identity_api_key.short.fingerprint
    region      = var.region
    compartment = oci_identity_compartment.ingress.id
    drg         = oci_core_drg.ingress.id
    address     = var.tunnel_address
    network     = var.vcn_cidr
  }) })
}