resource "random_password" "frigate_s3" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "frigate_s3" {
  mount                = vault_mount.secret.path
  name                 = "versitygw/users/model-reader"
  data_json_wo_version = 1
  data_json_wo = jsonencode({
    accessKeyId     = "model-reader"
    secretAccessKey = random_password.frigate_s3.result
  })
}

resource "vault_kv_secret_v2" "frigate_oauth2_proxy" {
  mount                = vault_mount.secret.path
  name                 = "frigate/oauth2-proxy"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_kv_secret_v2" "frigate_oauth2_proxy_cookie" {
  mount                = vault_mount.secret.path
  name                 = "frigate/oauth2-proxy-cookie"
  data_json_wo_version = 1
  data_json_wo         = jsonencode({})
}

resource "vault_policy" "frigate" {
  name = "frigate"

  policy = <<-EOT
    path "secret/data/frigate/rtsp" {
      capabilities = ["read"]
    }
    path "secret/data/frigate/oauth2-proxy" {
      capabilities = ["read"]
    }
    path "secret/data/frigate/oauth2-proxy-cookie" {
      capabilities = ["read"]
    }
    path "secret/data/quay/robots/cluster_pull" {
      capabilities = ["read"]
    }
    path "secret/data/versitygw/users/model-reader" {
      capabilities = ["read"]
    }
    path "pki/cert/ca" {
      capabilities = ["read"]
    }
  EOT
}

resource "vault_kubernetes_auth_backend_role" "frigate" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "frigate"
  bound_service_account_names      = ["frigate-vso"]
  bound_service_account_namespaces = ["frigate"]
  token_policies                   = [vault_policy.frigate.name]
  token_ttl                        = 3600
  token_max_ttl                    = 3600
}