ephemeral "vault_kv_secret_v2" "forgejo_public_user" {
  mount = "secret"
  name  = var.forgejo_public_vault_secret_path
}

locals {
  forgejo_public_secret_access_key = ephemeral.vault_kv_secret_v2.forgejo_public_user.data["secretAccessKey"]
}

resource "versitygw_user" "forgejo_public" {
  access_key_id     = var.forgejo_public_principal
  secret_access_key = local.forgejo_public_secret_access_key
  role              = "user"
}

resource "minio_s3_bucket" "forgejo_public" {
  bucket = var.forgejo_public_bucket_name
}

resource "minio_s3_bucket_policy" "forgejo_public" {
  bucket = minio_s3_bucket.forgejo_public.bucket

  depends_on = [
    versitygw_user.forgejo_public,
  ]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "ForgejoPublicBucketAccess"
        Effect    = "Allow"
        Principal = var.forgejo_public_principal
        Action = [
          "s3:GetBucketAcl",
          "s3:GetBucketLocation",
          "s3:ListBucket",
          "s3:ListBucketMultipartUploads",
        ]
        Resource = [
          "arn:aws:s3:::${var.forgejo_public_bucket_name}",
        ]
      },
      {
        Sid       = "ForgejoPublicObjectAccess"
        Effect    = "Allow"
        Principal = var.forgejo_public_principal
        Action = [
          "s3:AbortMultipartUpload",
          "s3:DeleteObject",
          "s3:GetObject",
          "s3:GetObjectAcl",
          "s3:ListMultipartUploadParts",
          "s3:PutObject",
          "s3:PutObjectAcl",
        ]
        Resource = [
          "arn:aws:s3:::${var.forgejo_public_bucket_name}/*",
        ]
      },
    ]
  })
}