resource "random_password" "versitygw_forgejo_secret_access_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "versitygw_forgejo_user" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/forgejo"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = random_password.versitygw_forgejo_secret_access_key.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
}

resource "random_password" "forgejo_dragonfly_password" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "dragonfly_forgejo_acl" {
  mount = vault_mount.secret.path
  name  = "dragonfly/forgejo/acl"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    acl = "user default on >${random_password.forgejo_dragonfly_password.result} ~* &* +@all\n"
  })

  # Vault is source of truth after first write. Re-runs do not rotate the ACL.
}

resource "vault_kv_secret_v2" "forgejo_secrets" {
  mount = vault_mount.secret.path
  name  = "forgejo/secrets"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secret_key        = "REPLACE_AFTER_EXTRACTION"
    internal_token    = "REPLACE_AFTER_EXTRACTION"
    oauth2_jwt_secret = "REPLACE_AFTER_EXTRACTION"
    lfs_jwt_secret    = "REPLACE_AFTER_EXTRACTION"
    redis_password    = random_password.forgejo_dragonfly_password.result
    s3_secret_key     = random_password.versitygw_forgejo_secret_access_key.result
    internal_ca_cert  = vault_pki_secret_backend_root_cert.root.certificate
  })

  # Manual escrow patches the Forgejo runtime keys after the path exists.
}