resource "oci_kms_vault" "relay" {
  compartment_id = local.compartment_id
  display_name   = "oci-l4-relay"
  vault_type     = "DEFAULT"
  freeform_tags  = var.freeform_tags
}

resource "oci_kms_key" "relay" {
  compartment_id      = local.compartment_id
  display_name        = "oci-l4-relay"
  management_endpoint = oci_kms_vault.relay.management_endpoint
  protection_mode     = "SOFTWARE"
  freeform_tags       = var.freeform_tags

  key_shape {
    algorithm = "AES"
    length    = 32
  }
}

resource "oci_vault_secret" "wireguard_seed" {
  compartment_id         = local.compartment_id
  key_id                 = oci_kms_key.relay.id
  secret_name            = "oci-l4-relay-wireguard-seed"
  vault_id               = oci_kms_vault.relay.id
  description            = "Seed material for the OCI relay WireGuard private key"
  enable_auto_generation = true
  freeform_tags          = var.freeform_tags

  secret_generation_context {
    generation_type     = "BYTES"
    generation_template = "BYTES_512"
  }
}

resource "oci_vault_secret" "wireguard_public_key" {
  compartment_id = local.compartment_id
  key_id         = oci_kms_key.relay.id
  secret_name    = "oci-l4-relay-wireguard-public-key"
  vault_id       = oci_kms_vault.relay.id
  description    = "Published OCI relay WireGuard public key"
  freeform_tags  = var.freeform_tags

  secret_content {
    content      = base64encode("pending")
    content_type = "BASE64"
  }

  lifecycle {
    ignore_changes = [secret_content]
  }
}

resource "oci_vault_secret" "log_ingest" {
  compartment_id = local.compartment_id
  key_id         = oci_kms_key.relay.id
  secret_name    = "oci-l4-relay-log-ingest"
  vault_id       = oci_kms_vault.relay.id
  description    = "Bearer credential for authenticated relay log ingestion"
  freeform_tags  = var.freeform_tags

  secret_content {
    content      = base64encode("pending")
    content_type = "BASE64"
  }

  lifecycle {
    ignore_changes = [secret_content]
  }
}