resource "forgejo_organization" "gitops" {
  name      = var.organization_name
  full_name = var.organization_full_name
}

resource "forgejo_repository" "gitops" {
  owner       = forgejo_organization.gitops.name
  name        = var.repository_name
  description = var.repository_description
  private     = true
  auto_init   = false

  lifecycle {
    prevent_destroy = true
  }
}

resource "tls_private_key" "flux_git" {
  algorithm = "ED25519"
}

resource "forgejo_deploy_key" "flux_git" {
  repository_id = forgejo_repository.gitops.id
  title         = var.flux_git_deploy_key_title
  key           = trimspace(tls_private_key.flux_git.public_key_openssh)
  read_only     = true
}

resource "vault_kv_secret_v2" "flux_git_ssh" {
  mount = var.vault_kv_mount
  name  = var.flux_git_ssh_vault_path

  data_json = jsonencode({
    identity       = tls_private_key.flux_git.private_key_pem
    "identity.pub" = trimspace(tls_private_key.flux_git.public_key_openssh)
    known_hosts    = trimspace(var.flux_git_ssh_known_hosts)
  })

  # Vault is source of truth after first write. Flux deploy key rotation is explicit.
  lifecycle { ignore_changes = [data_json] }
}